Answering to 5W Using Digital Forensics Data

In recent years the increasing capacity of storage devices, the advent of the cloud and the quantity of email, messages, chats, pictures and files exchanged, led the data to be analyzed and correlated by the digital investigators to be hundreds of times bigger than 15 years ago (Darren Quick, K.K.R.C., 2014). To permit a fast visualization of the data, applicable to different types of data and understandable even to non-expert people, we propose a proof of concept of a framework, defined Digital Forensics 5W (DF5W), that create a visualization of the data as answers to the 5W questions: Who, What, When, Where and Why. In order to test this idea, we developed a small prototype and tested it on two case studies: the ENRON dataset and a kidnap case. The results have revealed that answering to 5W using Digital Forensics Data is feasible and their use can display useful information in a narrative way. It is allowing the quick identification of possible groups of data that could need to be analyzed in deep.