HAL will be down for maintenance from Friday, June 10 at 4pm through Monday, June 13 at 9am. More information
Skip to Main content Skip to Navigation
Conference papers

Designing a Decision-Support Visualization for Live Digital Forensic Investigations

Abstract : Fileless Malware poses challenges for forensic analysts since the infected system often can’t be shut down for a forensic analysis. Turning off the device would destroy forensic artifacts or evidence of the fileless malware. Therefore, a technique called Live Digital Forensics is applied to perform investigations on a running system. During these investigations, domain experts need to carefully decide what tools they want to deploy for their forensic analysis. In this paper we propose a visualization designed to support forensic experts in this decision-making process. Therefore, we follow a design methodology from the visualization domain to come up with a comprehensible design. Following this methodology, we start with identifying and defining the domain problem which the visualization should help to solve. We then translate this domain problem into an abstract description of the available data and user’s tasks for the visualization. Finally, we transform these specifications into a visualization design for a Live Digital Forensics decision-support. A use case illustrates the benefits of the proposed method.
Document type :
Conference papers
Complete list of metadata

https://hal.inria.fr/hal-03243642
Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Monday, May 31, 2021 - 5:54:18 PM
Last modification on : Monday, May 31, 2021 - 6:08:53 PM

File

 Restricted access
To satisfy the distribution rights of the publisher, the document is embargoed until : 2023-01-01

Please log in to resquest access to the document

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Fabian Böhm, Ludwig Englbrecht, Günther Pernul. Designing a Decision-Support Visualization for Live Digital Forensic Investigations. 34th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jun 2020, Regensburg, Germany. pp.223-240, ⟨10.1007/978-3-030-49669-2_13⟩. ⟨hal-03243642⟩

Share

Metrics

Record views

32