Forensic Analysis Process Through

omputer forensics is the preservation, analysis, and interpretation of computer data [1]. There is a need for software that aids investigators in locating data on hard drives left by persons committing illegal activities. These software tools must reduce the tedious efforts of forensic examiners, especially when searching very large hard drives. A great deal of time is wasted by analysts trying to interpret massive amounts of data that isn’t correlated or meaningful without high levels of patience and tolerance for error. Visualization techniques can greatly aid forensic specialists to direct their search to suspicious files; in effect aiding the interpretation process. Essentially we are relying on the old adage: “A picture is worth a thousand words;” a saying derived from the fact that humans have the ability to visually interpret and comprehend pictures, video, and charts much faster than reading a textual description of the same. Indeed, humans perceive graphical images perceptually while text is perceived serially. VISUALIZATION