An Ontological Approach for Digital Evidence Search

Usage of emails for the fraudulent activities is accelerating with higher pace. There is a thirst need for the tools to analyze large collections emails forensically. Traditional Information Retrieval tools can retrieve documents those are relevant to the given query. But directly answering the questions specific to the forensics domain will make the job forensic examiners easy. In this paper a system is presented to answer questions specific to email forensics. Ontology is designed with the basic concepts of email forensics domain. Information relevant to the case under investigation is retrieved using Information Retrieval techniques. Ontology is dynamically populated with the retrieved information. Knowledge which is of interest to the forensic investigators is inferred by firing the domain specific rules with the help of inference engine. Some domain specific questions have been answered with the help of inferred knowledge. The proposed system is a prototype and it can stand as a base to develop bigger systems.