Designing a Decision-Support Visualization for Live Digital Forensic Investigations - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2020

Designing a Decision-Support Visualization for Live Digital Forensic Investigations

Fabian Böhm
  • Function : Author
  • PersonId : 1059329
Ludwig Englbrecht
  • Function : Author
  • PersonId : 1100419
Günther Pernul
  • Function : Author
  • PersonId : 1024075


Fileless Malware poses challenges for forensic analysts since the infected system often can’t be shut down for a forensic analysis. Turning off the device would destroy forensic artifacts or evidence of the fileless malware. Therefore, a technique called Live Digital Forensics is applied to perform investigations on a running system. During these investigations, domain experts need to carefully decide what tools they want to deploy for their forensic analysis. In this paper we propose a visualization designed to support forensic experts in this decision-making process. Therefore, we follow a design methodology from the visualization domain to come up with a comprehensible design. Following this methodology, we start with identifying and defining the domain problem which the visualization should help to solve. We then translate this domain problem into an abstract description of the available data and user’s tasks for the visualization. Finally, we transform these specifications into a visualization design for a Live Digital Forensics decision-support. A use case illustrates the benefits of the proposed method.
Fichier principal
Vignette du fichier
496047_1_En_13_Chapter.pdf (437.25 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03243642 , version 1 (31-05-2021)





Fabian Böhm, Ludwig Englbrecht, Günther Pernul. Designing a Decision-Support Visualization for Live Digital Forensic Investigations. 34th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jun 2020, Regensburg, Germany. pp.223-240, ⟨10.1007/978-3-030-49669-2_13⟩. ⟨hal-03243642⟩
42 View
11 Download



Gmail Facebook Twitter LinkedIn More