Temporal Network Based Evidence Analysis from Digital Data

The deluge in electronic data from emails and texts have necessitated the need for efficient forensic analysis techniques that includes organizing evidence, retrieval and reasoning. In this work, we propose a temporal network approach for organization of the electronic data to aid forensic analysis. We create an automated retrieval mechanism for relevant evidence leveraging on temporal data organization. The analyst is able to abstract and visualize the digital data by reasoning on temporal network model of evidence. The temporal network model have been implemented on datasets of, emails and text messages. The results and the effectiveness of the model, in addressing forensic queries are demonstrated for the datasets. This is the dataset used for the text message portion of our research (https://web.archive.org/web/20130921043042/http://cybersecurity.cit.purduecal.edu/content/tmcorpus.html). This is the dataset we used for the email portion of our research (https://www.kaggle.com/datasets/marawanxmamdouh/email-thread-summary-dataset).