Digital Forensics Infovis: An Implementation of a Process for Visualisation of Digital Evidence

Infovis enables us to combine the language of the eyes with the language of the mind, empowering all manner of people to be data detectives. Formalised processes for the integration of infovis techniques within the digital forensics domain are few and far between. One such process, the Explore, Investigate and Correlate process has been developed and provides a series of phases and key principles on which to build systems that integrate infovis techniques within the digital forensics investigative workflow. This paper presents refinements to this process and a proof-of-concept implementation. How the implementation achieves the goals of the process, the techniques it uses and how it helps to reduce information overload within the digital forensics domain are examined.