Assisting digital forensic analysis via exploratory information visualisation

Background: Digital forensics is a rapidly expanding field, due to the continuing advances in computer technology and increases in data stage capabilities of devices. However, the tools supporting digital forensics investigations have not kept pace with this evolution, often leaving the investigator to analyse large volumes of textual data and rely heavily on their own intuition and experience. Aim: This research proposes that given the ability of information visualisation to provide an end user with an intuitive way to rapidly analyse large volumes of complex data, such approached could be applied to digital forensics datasets. Such methods will be investigated; supported by a review of literature regarding the use of such techniques in other fields. The hypothesis of this research body is that by utilising exploratory information visualisation techniques in the form of a tool to support digital forensic investigations, gains in investigative effectiveness can be realised. Method:To test the hypothesis, this research examines three different case studies which look at different forms of information visualisation and their implementation with a digital forensic dataset. Two of these case studies take the form of prototype tools developed by the researcher, and one case study utilises a tool created by a third party research group. A pilot study by the researcher is conducted on these cases, with the strengths and weaknesses of each being drawn into the next case study. The culmination of these case studies is a prototype tool which was developed to resemble a timeline visualisation of the user behaviour on a device. This tool was subjected to an experiment involving a class of university digital forensics students who were given a number of questions about a synthetic digital forensic dataset. Approximately half were given the prototype tool, named Insight, to use, and the others given a common open-source tool. The assessed metrics included: how long the participants took to complete all tasks, how accurate their answers to the tasks were, and how easy the participants found the tasks to complete. They were also asked for their feedback at multiple points throughout the task. Results:The results showed that there was a statistically significant increase in accuracy for one of the six tasks for the participants using the Insight prototype tool. Participants also found completing two of the six tasks significantly easier when using the prototype tool. There were no statistically significant different difference between the completion times of both participant groups. There were no statistically significant differences in the accuracy of participant answers for five of the six tasks. Conclusions: The results from this body of research show that there is evidence to suggest that there is the potential for gains in investigative effectiveness when information visualisation techniques are applied to a digital forensic dataset. Specifically, in some scenarios, the investigator can draw conclusions which are more accurate than those drawn when using primarily textual tools. There is also evidence so suggest that the investigators found these conclusions to be reached significantly more easily when using a tool with a visual format. None of the scenarios led to the investigators being at a significant disadvantage in terms of accuracy or usability when using the prototype visual tool over the textual tool. It is noted that this research did not show that the use of information visualisation techniques leads to any statistically significant difference in the time taken to complete a digital forensics investigation.

Development of a transitioning approach to reduce surface water volumes in combined sewer systems

The overarching goal of this research is to establish a successful forum for a transition from the existing paradigm of managing wastewater infrastructure to a more sustainable paradigm that achieves a more efficient utilisation of wastewater assets. A transitioning approach to support a more efficient utilisation of surface water and wastewater assets and infrastructure is proposed and developed. The determined transitioning approach possesses key stages namely developing the arena, developing the agenda, case study, and monitoring. The case study stage investigates a drainage utility identifying their improvement drivers, the removal of surface water through detailed drainage modelling and the financial examination of the costs incurred under the various scenarios conducted. Understanding the implications of removing/attenuating surface water from the network is improved through obtaining data by detailed drainage modelling. Infoworks software is used to investigate and assess the current and future operational scenarios of a wastewater system operating over one calendar year. Modelling scenarios were conducted removing surface water from selected areas focusing on the volumes requiring pumping and durations of pumping station(s) operation prior to treatment during storm conditions. The financial implication of removing surface water in combined sewer systems is examined in three main components. Firstly the costs of electricity incurred at the single sewage pumping station (SPS) investigated during the various scenarios modelled require to be addressed. Secondly the costs to retrofit sustainable urban drainage system (SUDS) solutions needs to be identified. Thirdly the implications of removing surface water for the drainage utility at the national level and the potential saving for householder’s committing to a surface water disconnection rebate scheme. When addressed at the macro level i.e., with over 2,100 pumping stations, some operating in sequence and contained within one drainage utility annually treating 315,360 megalitres the significance of the same multiple quantifiable and intangible benefits becomes amplified. The research aims, objectives and findings are presented to the identified and convened stakeholders. The transitioning approach developed encourages positive discourse between stakeholders. The level of success of the transitioning approach determined is then tested using a quantitative methodology through the completion of questionnaires. From the questionnaires completed the respondents unanimously agreed that surface water flows should be removed as well as reduced from the combined sewer system. The respondents agreed that the removal of surface water from a typical combined sewer system is justified by applying a transitioning approach focusing on the energy consumption required to pump increased volumes during storm events. This response is significant based upon the economic evidence and is contrary to the respondents previous position that finance was their most influencing factor. When provided with other potentially available benefits the respondents were even more supportive of the justification to remove surface water from the combined sewer system. The combined findings of the work presented in this thesis provide further justification that the transitioning approach applied to the removal of surface water from a typical combined sewer system, as determined in this research has been successful.