DIEF: An Autopsy Module for Distributed Identification of E-mail Files from Disk Images

Hard drives are a predominant source of residual data in today’s digital environments. However, the increasing size of hard disks compounds the challenge of digital forensics, particularly in time-poor and resource-constrained forensic laboratories (e.g., due to the time required to recover residual data), using conventional digital investigation techniques. There are various types of information in the disk images such as e-mail data (a key source of information in disk images). However, it is time-consuming to identify and extract e-mail files from the disk images, when the hard disk size is big and contains large number of (other) files. We posit the importance of improving existing processes, for example by incorporating efficient and scalable processing mechanisms, to handle increasing volume of data. This study investigates the development of an Autopsy module for Distributed Identification of E-mail Files (DIEF). Initial experiments on the benchmark dataset show that DIEF achieves an average of 52% performance improvement in the process method, as compared to a traditional approach that does not employ distributed processing.