On the use of data visualization techniques to support digital forensic analysis: A survey of current approaches

The task of analysis within the digital forensic investigation lifecycle is examined and the support provided for its constituent activities by a representative sample of forensic tools evaluated. It is suggested that the core activity of analysis (i.e. the derivation of a testable high-level hypothesis or narrative of user behaviour) is a creative activity which depends primarily on the experience of the digital forensic analyst. Such activity is thus difficult to formalise and difficult to support with tools. It is further reasoned that the interactive and exploratory nature of data-visualization (data-viz) is synergistic with the problem and thus provides a suitable basis for the provision of analytical tool support.