Creating and understanding email communication networks to aid digital forensic investigations
This work addresses the need for digital forensic analysts to understand social networks, but it is incremental as it applies existing network analysis methods to a new domain.
The paper tackled the problem of automatically constructing social networks from email addresses on hard drives for digital forensic investigations, achieving validation against ground truth data from interviews with drive owners.
Digital forensic analysts depend on the ability to understand the social networks of the individuals they investigate. We develop a novel method for automatically constructing these networks from collected hard drives. We accomplish this by scanning the raw storage media for email addresses, constructing co-reference networks based on the proximity of email addresses to each other, then selecting connected components that correspond to real communication networks. We validate our analysis against a tagged data-set of networks for which we determined ground truth through interviews with the drive owners. In the resulting social networks, we find that classical measures of centrality and community detection algorithms are effective for identifying important nodes and close associates.