Search

The dataset consists of records from the NTFS file system and event logs. In this study, we used images of devices from capture the flags competitions focused on the digital forensic of Windows operating systems and user activities. We created timelines of the security incident from the disk images using the Plaso tool, which we then processed and transformed the attributes of the timelines into binary values to simplify the application of data analysis and machine learning methods. The data are divided into 12 different files, and they are saved in CSV format.

Adli bilişim sürecinde çok çeşitli yazılımlar ve donanımlar kullanılmaktadır. Teknolojinin hızlı gelişimine paralel olarak dijital delillerin toplandığı cihazlar da hızla çeşitlenmektedir. Android mobil telefonlardan toplanan dijital deliller yardımı ile bu telefona sahip kişinin arkadaşlarının ve bu arkadaşları ile ilişkilerinin derecelendirilerek tespit edilmesi, literatürde çalışılmış ve üzerinde çalışılmaya devam eden konulardan biridir. Bu çalışmada geliştirilen yazılım, Android işletim sistemine sahip mobil cihazlardan fiziksel ve mantıksal imaj alma, imajın incelenmek üzere açılması, imaj içinde farklı dosya türlerinin incelenmesi, veri tabanı incelemeleri gibi dijital delil niteliği taşıyan birçok veriye erişilmesini sağlamaktadır. Delil elde etme, delilleri inceleme ve raporlama işlemlerini yapabilen bu yazılım aynı zamanda geliştirilen analiz modeliyle mobil cihazlardan elde edilen sosyal medya uygulama verileri, telefon rehberi ve görüşme kayıtları arasındaki ilişkileri inceleyerek suçlunun veya hesapları incelenen kişilerin, ilişkili olma ihtimali yüksek kişileri tespit edebilmektedir. Birçok işlemi tek bir ara yüzden yapabilmesi ve veri analiz yöntemi bakımından, özgün bir çalışma olarak gerçekleştirilen yazılımla incelenen deliller ve elde edilen bulgular bu çalışmada sunulmuştur.

During the digital forensic process, different software and hardware tools are used. The devices from which the digital evidences are collected have been varied in parallel with the developments in technology. The issue of identifying the mobile phone owner’s friends and assessing his relationship with them with the help of digital evidences collected from the Android mobile phones has been studied in the literature and it is still under investigation. The software developed in this work enables accessing a variety of data that have evidential value in the court proceedings; these include physical and logical acquisition of images from mobile phones with Android operating system, extracting images for investigations, examining different file types in images, and databases. This software can collect and examine the evidences and then produce reports. At the same time, it can identify criminals or people with potentially have connections to those people whose accounts are under investigations by using developed analysis model which examines the relationships between social media applications` data, phone contacts and calling histories collected from the mobile devices. In this work, the evidences examined by using a novel software developed by the authors which performs multiple tasks using a single interface and the corresponding results are presented.

During the digital forensic process, different software and hardware tools are used. The devices from which the digital evidences are collected have been varied in parallel with the developments in technology. The issue of identifying the mobile phone owner's friends and assessing his relationship with them with the help of digital evidences collected from the Android mobile phones has been studied in the literature and it is still under investigation. The software developed in this work enables accessing a variety of data that have evidential value in the court proceedings; these include physical and logical acquisition of images from mobile phones with Android operating system, extracting images for investigations, examining different file types in images, and databases. This software can collect and examine the evidences and then produce reports. At the same time, it can identify criminals or people with potentially have connections to those people whose accounts are under investigations by using developed analysis model which examines the relationships between social media applications' data, phone contacts and calling histories collected from the mobile devices. In this work, the evidences examined by using a novel software developed by the authors which performs multiple tasks using a single interface and the corresponding results are presented. [ABSTRACT FROM AUTHOR]