NPS Researchers Win Best Paper Award on Digital Forensics, Cyber Crime
Asset Publisher
Courtesy photo
NPS Researchers Win Best Paper Award on Digital Forensics, Cyber Crime
By PO2 Michael Ehrlich
NPS Associate Professor of Applied Mathematics Dr. Ralucca Gera, left, and Professor of Computer Science Dr. Neil Rowe, right, are presented with the Best Paper Award at the Eighth International Conference on Digital Forensics and Computer Crime in New York City for their paper "Making Sense of Email Addresses on Drives." The paper explores techniques for obtaining information on an individual's social network through e-mail addresses hidden within the raw drive data independent of standard file systems.
"Using this data, we can build a picture of the social networks that a drive owner participated in, even perhaps better than investigating their online profiles maintained by social-networking services, because drives contain much data that users have not approved for public display," explained Rowe.
The paper, coauthored by Rowe, Gera, and Research Associates Riqui Schwamm and Michael McCarrin, describes the utilization of a series of filters that are able to remove extraneous addresses. A careful analysis of the remaining e-mail addresses can provide forensic investigators with a solid picture of the social network of the individual who owned the drive.
"This work is important in finding insurgent and terrorist networks during military operations," stressed Rowe. "Insurgents and terrorists depend on e-mail and these methods can find who they are communicating with, even when they are careful to try to delete mail as soon as it is read. Whenever we capture mobile devices and computers in raids, we can analyze them using these methods," said Rowe.
NPS Associate Professor of Applied Mathematics Dr. Ralucca Gera, left, and Professor of Computer Science Dr. Neil Rowe, right, are presented with the Best Paper Award at the Eighth International Conference on Digital Forensics and Computer Crime in New York City for their paper "Making Sense of Email Addresses on Drives." The paper explores techniques for obtaining information on an individual's social network through e-mail addresses hidden within the raw drive data independent of standard file systems.
"Using this data, we can build a picture of the social networks that a drive owner participated in, even perhaps better than investigating their online profiles maintained by social-networking services, because drives contain much data that users have not approved for public display," explained Rowe.
The paper, coauthored by Rowe, Gera, and Research Associates Riqui Schwamm and Michael McCarrin, describes the utilization of a series of filters that are able to remove extraneous addresses. A careful analysis of the remaining e-mail addresses can provide forensic investigators with a solid picture of the social network of the individual who owned the drive.
"This work is important in finding insurgent and terrorist networks during military operations," stressed Rowe. "Insurgents and terrorists depend on e-mail and these methods can find who they are communicating with, even when they are careful to try to delete mail as soon as it is read. Whenever we capture mobile devices and computers in raids, we can analyze them using these methods," said Rowe.