| Computer forensics is the preservation, analysis, and interpretation of computer data. There is a need for software that aids investigators in locating data on hard drives left by persons committing illegal activities. These software tools should reduce the tedious efforts of forensic examiners, especially when searching large hard drives. A method is proposed here that uses visualization techniques to represent file statistics, such as file size, last access date, creation date, last modification date, owner, and file type. The user interface to this software allows file searching, pattern matching, and display of file contents. By viewing file information graphically, the developed software will reduce the examiner's analysis time and greatly increase the probability of locating criminal evidence. |
