Social Network Graphs in Email Forensics: Analysis of a Personal Email Dataset
摘要
Visualisation techniques to aid in email forensic investigations was proposed in the literature, often social network graphs. Current literature does not deal with the interpretation and insights that can be gained from the graphs. When many nodes are depicted in such a graph, it becomes difficult to extract useful insights from social network graphs. This article starts to address this shortcoming by interpreting a social network graph constructed from an email box, containing more than 60 000 emails, with 4 380 email addresses (nodes), and 8 132 edges in the resulting graph. The main contributions of this paper are, to demonstrate how to interpret social email graphs, simplify the graphs to improve interpretation, and identify structures which provides insights into the possible emails that flowed, e.g. mailing lists. The main results are summarised in the form of 11 deductions taken from the exploratory analysis of the graph from the personal email dataset.