Assisting digital forensic analysis via exploratory information visualisation

Background: Digital forensics is a rapidly expanding field, due to the continuing advances in computer technology and increases in data stage capabilities of devices. However, the tools supporting digital forensics investigations have not kept pace with this evolution, often leaving the investigator to analyse large volumes of textual data and rely heavily on their own intuition and experience. Aim: This research proposes that given the ability of information visualisation to provide an end user with an intuitive way to rapidly analyse large volumes of complex data, such approached could be applied to digital forensics datasets. Such methods will be investigated; supported by a review of literature regarding the use of such techniques in other fields. The hypothesis of this research body is that by utilising exploratory information visualisation techniques in the form of a tool to support digital forensic investigations, gains in investigative effectiveness can be realised. Method:To test the hypothesis, this research examines three different case studies which look at different forms of information visualisation and their implementation with a digital forensic dataset. Two of these case studies take the form of prototype tools developed by the researcher, and one case study utilises a tool created by a third party research group. A pilot study by the researcher is conducted on these cases, with the strengths and weaknesses of each being drawn into the next case study. The culmination of these case studies is a prototype tool which was developed to resemble a timeline visualisation of the user behaviour on a device. This tool was subjected to an experiment involving a class of university digital forensics students who were given a number of questions about a synthetic digital forensic dataset. Approximately half were given the prototype tool, named Insight, to use, and the others given a common open-source tool. The assessed metrics included: how long the participants took to complete all tasks, how accurate their answers to the tasks were, and how easy the participants found the tasks to complete. They were also asked for their feedback at multiple points throughout the task. Results:The results showed that there was a statistically significant increase in accuracy for one of the six tasks for the participants using the Insight prototype tool. Participants also found completing two of the six tasks significantly easier when using the prototype tool. There were no statistically significant different difference between the completion times of both participant groups. There were no statistically significant differences in the accuracy of participant answers for five of the six tasks. Conclusions: The results from this body of research show that there is evidence to suggest that there is the potential for gains in investigative effectiveness when information visualisation techniques are applied to a digital forensic dataset. Specifically, in some scenarios, the investigator can draw conclusions which are more accurate than those drawn when using primarily textual tools. There is also evidence so suggest that the investigators found these conclusions to be reached significantly more easily when using a tool with a visual format. None of the scenarios led to the investigators being at a significant disadvantage in terms of accuracy or usability when using the prototype visual tool over the textual tool. It is noted that this research did not show that the use of information visualisation techniques leads to any statistically significant difference in the time taken to complete a digital forensics investigation.

Parental mediation, YouTube’s networked public, and the baby-iPad encounter: mobilizing digital dexterity.

This study collected a sample of YouTube videos in which parents recorded their young children utilizing mobile touchscreen devices. Focusing on the more frequently viewed and highly-discussed videos, the paper analyzes the ways in which babies’ ‘digital dexterity’ is coded and understood in terms of contested notions of ‘naturalness’, and how the display of these capabilities is produced for a networked public. This reading of the ‘baby-iPad encounter’ helps expand existing scholarly concepts such as parental mediation and technology domestication. Recruiting several theoretical frameworks, the paper seeks to go beyond concerns of mobile devices and immobile children by analyzing children’s digital dexterity not just as a kind of mobility, but also as a set of reciprocal mobilizations that work across domestic, virtual and publically networked spaces.

Playing with sound and gesture in digital audio games

This article introduces the genre of a digital audio game and discusses selected play interaction solutions implemented in the Audio Game Hub, a prototype designed and evaluated in the years 2014 and 2015 at the Gamification Lab at Leuphana University Lüneburg.1 The Audio Game Hub constitutes a set of familiar playful activities (aiming at a target, reflex-based reacting to sound signals, labyrinth exploration) and casual games (e.g. Tetris, Memory) adapted to the digital medium and converted into the audio sphere, where the player is guided predominantly or solely by sound. The authors will discuss the design questions raised at early stages of the project, and confront them with the results of user experience testing performed on two groups of sighted and one group of visually impaired gamers.

Playful laboratories: the significance of games for knowledge production in the digital age

Presented at DiGRA 2015 Diversity of Play, Leuphana University, Lüneburg, Germany, on the 15th of May 2015.

Ludification of work or labourisation of play? On work/play interferences in the digital times.

Presented at Money and Games: 12th annual Game Research Lab Spring seminar, University of Tampere, Finland, on the 19th of April 2016.

Infants, interfaces, and intermediation: digital parenting and the production of 'iPad baby' videos on YouTube

We investigate the ways young children’s use of mobile touchscreen interfaces is both understood and shaped by parents through the production of YouTube videos and discussions in associated comment threads. This analysis expands on, and departs from, theories of parental mediation, which have traditionally been framed through a media effects approach in analyzing how parents regulate their children’s use of broadcast media, such as television, within family life. We move beyond the limitations of an effects framing through more culturally and materially oriented theoretical lenses of mediation, considering the role mobile interfaces now play in the lives of infants through analysis of the ways parents intermediate between domestic spaces and networked publics. We propose the concept of intermediation, which builds on insights from critical interface studies as well as cultural industries literature to help account for these expanded aspects of digital parenting. Here, parents are not simply moderating children’s media use within the home, but instead operating as an intermediary in contributing to online representations and discourses of children’s digital culture. This intermediary role of parents engages with ideological tensions in locating notions of “naturalness:” the iPad’s gestural interface or the child’s digital dexterity.

Using multiple GPUs to accelerate string searching for digital forensic analysis

String searching within a large corpus of data is an important component of digital forensic (DF) analysis techniques such as file carving. The continuing increase in capacity of consumer storage devices requires corresponding im-provements to the performance of string searching techniques. As string search-ing is a trivially-parallelisable problem, GPGPU approaches are a natural fit – but previous studies have found that local storage presents an insurmountable performance bottleneck. We show that this need not be the case with modern hardware, and demonstrate substantial performance improvements from the use of single and multiple GPUs when searching for strings within a typical forensic disk image.