Semantic Modelling of Digital Forensic Evidence

Abstract. The reporting of digital investigation results are traditionally carried out in prose and in a large investigation may require successive communication of findings between different parties. Popular forensic suites aid in the reporting process by storing provenance and positional data but do not automatically encode why the evidence is considered important. In this paper we introduce an evidence management method-ology to encode the semantic information of evidence. A structured vo-cabulary of terms, ontology, is used to model the results in a logical and predefined manner. The descriptions are application independent and automatically organised. The encoded descriptions aim to help the in-vestigation in the task of report writing and evidence communication and can be used in addition to existing evidence management techniques