Beyond Keywords

Description: Is keyword search becoming obsolete in the new age of forensic digital investigation? As the bulk of investigative activity moved from paper to digital documents, keyword searching became the primary tool for identifying relevant evidence in a data set. However, keywords can be imprecise. A search may miss important items or return too many irrelevant results. As data volumes grow, investigators must trawl through ever-increasing numbers of search results to find the information they seek. Traditional digital investigation tools present these results in lists and tables. It quickly becomes too much for the human mind to take in. Data visualization provides a much easier way for the brain to understand large quantities of data. This paper will discuss how investigators can use visualization to rapidly focus on the items of interest within very large data sets.