Computer Profiling for Preliminary Forensic Examination

Abstract. The quantity problem and the natural desire of law enforce-ment to confront suspects with evidence of their guilt close to the time of arrest in order to elicit a confession combine to form a need for both effec-tive digital forensic triage and preliminary forensic examination. This paper discusses computer profiling, a method for automated formal rea-soning about a computer system, and its applicability to the problem domain of preliminary digital forensic examination following triage. It proposes an algorithm for using computer profiling at the preliminary examination stage of an investigation, which focusses on constructing an information model describing a suspect’s computer system in the min-imal level of detail necessary to address a formal hypothesis about the system proposed by an investigator. The paper concludes by discussing the expanded utility of the algorithm proposed when contrasted to exist-ing approaches in the digital forensic triage and preliminary examination space