Proposal for Efficient Searching and Presentation in Digital Forensics

Digital forensics is a scientific, logical technique and procedure to collect, keep, and analyze digital data and to report the evidence discovered from them. And purposely, we can define it as an investigative technique to examine any kind of behavior using a computer and to prove the fact relation of it based on the data stored in the computer. Therefore, for digital forensics, it is required to obtain an image copy of original digital data without damage and to prove that the computer evidence existed in the specific time. After the evidence is analyzed, it needs to do with documentation in order to adopt it as legally effective evidence in the law court. As to the digital forensic, it is one of the important requisites of the search tool to present all matched results from the given query keyword. However, because existing forensic search tools just present the results without a kind of grouping or inappropriate filtering, a criminal investigator has to spend a lot of time in order to find documents related to the investigation among the searched results. In this paper, to solve this kind of problem, we propose a method that we find all desired results in a search procedure and thereafter evaluate and rank the results according to their fitness. As a result, meaningful information in investigative perspective is to be presented in the front part of the search result list and it is expected to minimize the time for the criminal investigator to perform filtering unnecessary data and it can contribute to improve the task efficiency.