Assisting digital forensics investigations by identifying social communication irregularities

Abstract

People are creatures of habit, favouring the familiar over unpredictability, which causes them to usually follow set patterns or routines. This is especially true for social interaction or communication where people tend to prefer familiar or well-known social relationships with close family and friends. This preferred social communication is often reflected by people’s usage of their smartphones. Change in social communication patterns can occur, but may be deemed exception or unusual and, therefore, such changes or irregularities must be identifiable. The identification of irregular social communication can offer insight to an examiner involved in a digital forensics investigation. Smartphone technology, however, evolves continuously, allowing for increasing amounts of social-related data to originate and be stored on the smartphone. In order to identify social communication irregularities with regards to smartphone usage, examiners are required to manually trawl through the data. This can become a very time-consuming process, leading the examiner to search for a needle in a haystack. This paper, therefore, introduces a new digital forensic analysis tool, called the Smartphone Modelling and Reconstruction Tool (SMaRT). The purpose of SMaRT is to specifically pinpoint social communication irregularities by analysing smartphone data. SMaRT achieves this functionality by combining data extraction, reconstruction and visualisation techniques to determine social patterns and locate irregularities. To determine the efficiency and evaluate the performance of SMaRT, a case study involving smartphone data is conducted. The outcome of the case study reveals that SMaRT can successfully analyse smartphone data and allows for the identification of patterns, associations and potential irregularities in an effective and timely manner.