Dr. Bhavani Thuraisingham The University of Texas at Dallas Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas XIRAF – XML-based indexing and querying for digital forensics

Abstract of Paper 1 This paper describes a novel, XML-based approach towards managing and querying forensic traces extracted from digital evidence. This approach has been implemented in XIRAF, a prototype system for forensic analysis. XIRAF systematically applies forensic analysis tools to evidence files (e.g., hard disk images). Each tool produces structured XML annotations that can refer to regions (byte ranges) in an evidence file. XIRAF stores such annotations in an XML database, which allows us to query the annotations using a single, powerful query language (XQuery). XIRAF provides the forensic investigator with a rich query environment in which browsing, searching, and predefined query templates are all expressed in terms of XML database queries

Introduction Framework for forensic analysis called XIRAF A clean separation between feature extraction and analysis Features extracted are stored in XML format A single, XML-based output format for forensic analysis tools The use of XML database technology for storing and querying the XML output of analysis tools.

XIRAF Framework Consists of three components Feature extraction manager Features are extracted from BLOBs (Binary large objects) using feature extraction tools Output of the tools are coded in XML for the forensics analyzer Tool repository Tools are wrapped (e.g., object wrappers) Storage subsysystem Stores BLOBs and XML annotations XQuery used to query XML data

Forensic Applications Authors have implemented following applications Timeline browser: Through web browser examiner can look at data/time of interest Photo search Search for images satisfying certain conditions Child pornography detection Using hashing carried out matching

Summary and Directions The separation of feature extraction and analysis brings benefits to both phases. XIRAF extracts features automatically, which is essential when processing large input sets. The use of XML as a common, intermediate output format for tools allows the integration of the output of diverse, independent tools that produce similar information. This handles both the heterogeneity present in the input data (e.g., different browser types) and with the diversity of forensic analysis tools. These benefits are demonstrated both by the timeline browser and by child pornography detection program. By storing extracted features in an XML database system one can analyze those features using a single, general-purpose, powerful query language. In addition, we benefit automatically from advances that are made in the area of XML database systems Directions: Use semantic web technologies?