XIRAF - XML-based indexing and querying for digital forensics

Authors:
W. Alink;R. A. F. Bhoedjang;P. A. Boncz;A. P. De Vries
Affiliations:
Netherlands Forensic Institute (NFI), Laan van Ypenburg 6, The Hague, The Netherlands;Netherlands Forensic Institute (NFI), Laan van Ypenburg 6, The Hague, The Netherlands;Centrum voor Wiskunde en Informatica (CWI), Amsterdam, The Netherlands;Centrum voor Wiskunde en Informatica (CWI), Amsterdam, The Netherlands
Venue:
Digital Investigation: The International Journal of Digital Forensics & Incident Response
Year:
2006

Citing 4
Cited 4

Computer and Intrusion Forensics

Computer and Intrusion Forensics
MonetDB/XQuery: a fast XQuery processor powered by a relational engine

Proceedings of the 2006 ACM SIGMOD international conference on Management of data
On the role of file system metadata in digital forensics

Digital Investigation: The International Journal of Digital Forensics & Incident Response
The future of forensic computing

Digital Investigation: The International Journal of Digital Forensics & Incident Response

Search by strategy

ESAIR '10 Proceedings of the third workshop on Exploiting semantic annotations in information retrieval
DEX: Digital evidence provenance supporting reproducibility and comparison

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Post-retrieval search hit clustering to improve information retrieval effectiveness: Two digital forensics case studies

Decision Support Systems
A multimedia analytics framework for browsing image collections in digital forensics

Proceedings of the 20th ACM international conference on Multimedia

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper describes a novel, XML-based approach towards managing and querying forensic traces extracted from digital evidence. This approach has been implemented in XIRAF, a prototype system for forensic analysis. XIRAF systematically applies forensic analysis tools to evidence files (e.g., hard disk images). Each tool produces structured XML annotations that can refer to regions (byte ranges) in an evidence file. XIRAF stores such annotations in an XML database, which allows us to query the annotations using a single, powerful query language (XQuery). XIRAF provides the forensic investigator with a rich query environment in which browsing, searching, and predefined query templates are all expressed in terms of XML database queries.