Improving the Efficiency of Digital Forensic Search by Means of the Constrained Edit Distance

A new search procedure is presented that makes use of the constrained edit distance in the preselection of the areas of the digital forensic search space that are interesting for the investigation. The constraints regard the maximum numbers of consecutive deletions and insertions. The original algorithm for computing the constrained edit distance is modified in order to be used in forensic search. The modification removes the constraints before the first substitution and after the last substitution. The advantage of the new method over the use of the unconstrained edit distance in the same procedure lies in the possibility of eliminating the need for finer exhaustive search in the fragments of the search space, in which the detected subsequence is too distorted. It also enables better control over the search process in the case of deliberate distortion of the evidence strings. Experimental results show that the proposed method offers data set reduction in the typical cases of as much as 80% compared to the method that uses unconstrained edit distance.