Forensic Corpora : A Challenge for Forensic Research

Research in the field of computer forensics is hobbled by the lack of realistic data. Academics are not developing automated techniques and tools because they lack the raw data necessary to develop and validate algorithms. Investigators that have access to real data operate under legal and practical restraints that prevent the data from being used in research. To make progress, we must “prime the pump” by collecting or creating forensic corpora that can be used by researchers. We must also pursue targeted technical developments in forensic file formats, knowledge representation, inference techniques, and the presentation of forensic results. 1 Computer Forensics and Today’s Forensic Tools Today’s computer forensic research is largely divided according to the kind of data being analyzed, rather than the kind of analysis being performed. There is disk forensics, network forensics, RAM forensics, cell phone and small device forensics, document forensics and software forensics. Research in all of these areas is limited by the inability of experimenters to obtain large datasets that are realistic, varied, and representative of the data from the field. Because they lack data, researchers can’t pursue many of the problems faced by today’s forensic practitioners. Today much of the work in the field of computer forensics is focused on visualizing tools, data extraction techniques, and algorithm development. But this work is generally performed on small data sets provided by the experiment. Few algorithms are validated on a wide range of data, and few tools developed by researchers work reliably in the field when they are exposed to data that is not conformant with the test sets. Even more troubling, researchers are missing algorithms and techniques that require massive amounts of information for proper operation. This paper proposes the creation of large-scale forensic corpora that meet these requirements: 1. Representative of data encountered during the course of criminal investigations, civil litigation, and intelligence operations.