Automating case reports for the analysis of digital evidence
Loading...
Authors
Cassidy, Regis H. Friend
Subjects
Advisors
Eagle, Chris
Date of Issue
2005-09
Date
Publisher
Monterey, California. Naval Postgraduate School
Language
Abstract
The reporting process during computer analysis is critical in the practice of digital forensics. Case reports are used to review the process and results of an investigation and serve multiple purposes. The investigator may refer to these reports to monitor the progress of his analysis throughout the investigation. When acting as an expert witness, the investigator will refer to organized documentation to recall past analysis. A lot of time can elapse between the analysis and the actual testimony. Specific reports may also be used in court as visual aids. Not all cases make it to court, but corporate managers will still likely want to review a case report. Since digital forensics is a relatively new field and can have a high learning curve, reports may be used as a mechanism for sharing knowledge of digital forensic practices. Existing open source forensics tools are an inexpensive alternative to commercial products, but lack the functionality to generate case reports. Open source tools are more likely to be accepted by the professional forensics community with this added capability. This thesis adds case report features to the Sleuth Kit and Autopsy Forensic Browser suite of tools, the premiere open-source forensics analysis software currently available.
Type
Thesis
Description
Series/Report No
Department
Department of Computer Science
Organization
Naval Postgraduate School
Identifiers
NPS Report Number
Sponsors
Funder
Format
xvi, 217 p. : col. ill. ;
Citation
Distribution Statement
Approved for public release; distribution is unlimited.