Air Force Institute of Technology AFIT Scholar Theses and Dissertations Student Graduate Works 3-22-2019 Graph-based Temporal Analysis in Digital Forensics Nikolai A. Adderley Follow this and additional works at: https://scholar.afit.edu/etd Part of the Data Storage Systems Commons, and the Hardware Systems Commons Recommended Citation Adderley, Nikolai A., "Graph-based Temporal Analysis in Digital Forensics" (2019). Theses and Dissertations. 2241. https://scholar.afit.edu/etd/2241 This Thesis is brought to you for free and open access by the Student Graduate Works at AFIT Scholar. It has been accepted for inclusion in Theses and Dissertations by an authorized administrator of AFIT Scholar. For more information, please contact [email protected]. GRAPH-BASED TEMPORAL ANALYSIS IN DIGITAL FORENSICS THESIS Nikolai A. Adderley, 1stLt, USAF AFIT-ENG-MS-19-M-005 DEPARTMENT OF THE AIR FORCE AIR UNIVERSITY AIR FORCE INSTITUTE OF TECHNOLOGY Wright-Patterson Air Force Base, Ohio DISTRIBUTION STATEMENT A APPROVED FOR PUBLIC RELEASE; DISTRIBUTION UNLIMITED. The views expressed in this document are those of the author and do not reflect the official policy or position of the United States Air Force, the United States Department of Defense or the United States Government. This material is de- clared a work of the U.S. Government and is not subject to copyright protection in the United States. AFIT-ENG-MS-19-M-005 GRAPH-BASED TEMPORAL ANALYSIS IN DIGITAL FORENSICS THESIS Presented to the Faculty Department of Electrical and Computer Engineering Graduate School of Engineering and Management Air Force Institute of Technology Air University Air Education and Training Command in Partial Fulfillment of the Requirements for the Degree of Master of Science in Electrical Engineering Nikolai A. Adderley, B.S 1stLt, USAF March 2019 DISTRIBUTION STATEMENT A APPROVED FOR PUBLIC RELEASE; DISTRIBUTION UNLIMITED. AFIT-ENG-MS-19-M-005 GRAPH-BASED TEMPORAL ANALYSIS IN DIGITAL FORENSICS THESIS Nikolai A. Adderley, B.S 1stLt, USAF Committee Membership: Dr. Gilbert L. Peterson Chair Dr. Robert Mills Member Dr. Douglas Hodson Member AFIT-ENG-MS-19-M-005 Abstract Establishing a timeline as part of a digital forensics investigation is a vital part of understanding the order in which system events occurred. However, most digital forensics tools present timelines as histogram or as raw artifacts. Conse- quently, digital forensics examiners are forced to rely on manual, labor-intensive practices to reconstruct system events. Current digital forensics analysis tools are at their technological limit with the increasing storage and complexity of data. A graph-based timeline can present digital forensics evidence in a structure that can be immediately understood and effortlessly focused. This paper presents the Tem- poral Analysis Integration Management Application (TAIMA) to enhance digital forensics analysis via information visualization (infovis) techniques. TAIMA is a prototype application that provides a graph-based timeline for event reconstruc- tion using abstraction and visualization techniques. A workflow illustration and pilot usability study provided evidence that TAIMA assisted digital forensics spe- cialists in identifying key system events during digital forensics analysis. iv Acknowledgements To my loving and supportive wife and children. Thank you for your sacrifice over the last two years and always being in my corner making sure I had all the love and support I needed to get through this. Additionally, I would like to thank my thesis chair and supervisor Dr. Gilbert L. Peterson for his astute guidance, patience and direction throughout my course work and thesis process. Moreover, I would also like to thank Capt. Daniel Schelkoph for his efforts in creating a test Neo4j database and assistance in incorporating it into TAIMA. Nikolai A. Adderley v Table of Contents Page Abstract . iv Acknowledgements . .v List of Figures . ix List of Tables . xi I. Introduction . .1 1.1 Digital Forensics . .3 1.2 Problem Statement . .5 1.3 Research Hypotheses . .6 1.4 Research Questions . .7 1.5 Contributions . .8 1.6 Organization of the Thesis . .9 II. Literature Review . 10 2.1 Information Visualization (infovis) Frameworks . 11 2.1.1 The Visual Information Seeking Mantra . 12 2.1.2 The Explore, Investigate and Correlate (EIC) Conceptual Framework . 14 2.1.3 Visualization Pipeline . 15 2.2 Abstraction . 17 2.2.1 Temporal Event Abstraction . 17 2.3 Temporal Analysis . 19 2.4 Digital Forensics Timelines . 19 2.4.1 Text-based Timeline . 21 2.4.2 Graph-based Timeline Analysis Studies . 22 2.5 Human-Computer Interaction (HCI) and Usability Testing . 25 2.5.1 Usability Testing . 26 III. Temporal Analysis Integration Management Application (TAIMA) ...................................................... 28 3.1 GRANDStack (GraphQL, React, Apollo, Neo4j Database) . 30 3.1.1 GraphQL . 31 3.1.2 Apollo Client . 31 3.1.3 React (JavaScript Library) . 31 3.1.4 Neo4j . 32 vi Page 3.1.5 Rendering the Grahical Timeline . 32 3.2 Data Transformation. 33 3.2.1 Import Data Acquisition . 33 3.2.2 Adaptive Data Reduction . 34 3.2.3 Visibility Transformation . 34 3.2.4 Viewing Transformation . 36 3.2.5 Rendering . 36 3.2.6 Visual Display . 37 3.3 The Interface . 37 3.3.1 Sheiderman Requirements . 38 3.4 The Data Model . 39 3.5 Temporal Event Abstraction . 41 3.6 TAIMA Workflow . 45 3.7 The Interface: Input Fields . 46 3.8 The Timeline . 47 3.9 Zoom...................................................... 49 3.10 Traces . 49 3.11 Summary . 50 IV. Research Design/Strategy . 52 4.1 Evaluating User Experience (UE) . 52 4.1.1 Disk Image . 53 4.1.2 Task Description . 54 4.1.3 Population Selection . 55 4.1.4 Evaluation Technique . 56 4.1.5 Data Analysis Procedure . 57 4.1.6 Research Limitations . 58 V. Results & Analysis . 60 5.1 Abstraction Evaluation . 60 5.2 Data Analysis . 62 5.2.1 Evaluating User Experience (UE) results . 62 5.2.2 Performance . 63 5.2.3 Accuracy . 63 5.2.4 Usability . 64 VI. Conclusion . 72 6.1 Results . 73 6.2 Limitations . 74 6.3 Future Work . 75 vii Page Appendix A. Approval . 77 Appendix B. Institutional Review Board Memorandum . 78 Appendix C. Study Instructions . 89 Appendix D. Raw Data . ..