Automated Assessment of Artefact Relevance Using Artefact Metadata and Correlated Timeline Events
摘要
Digital forensic data backlogs that span years are a major concern for law enforcement organizations globally and can hinder court processes. This problem is brought on by the increasing number of cases that call for digital forensic examination as well as the exponential rise in the volume of data that is involved in each case. Leveraging the previously analyzed instances and components of digital forensics can be crucial in resolving this issue. There is a chance to use evidence-based automated artificial intelligence training systems for processing by classifying artefacts according to their relevance. These systems can be very helpful to researchers in organizing and compiling data. A method for assessing file artefact significance is provided by one suggested methodology, the Automated Artefact Classification during Digital Forensic Investigation (AACDFI), which is especially helpful during the examination stage of digital forensic investigations. This method allows the utilization of previously identified relevant files to categorize newly discovered files using machine learning algorithms. These files are identified during the acquisition step through an automated artefact detection model, where trained models play a crucial role. By utilizing filesystem metadata and associated temporal events for each artefact, the method assigns a relevancy score based on file similarity.