Investigation Ontology a b s t r a c t This paper presents DIALOG (Digital Investigation Ontology); a framework for the management, reuse, and analysis of Digital Investigation knowledge. DIALOG provides a general, application independent vocabulary that can be used to describe an investigation at different levels of detail. DIALOG is defined to encapsulate all concepts of the digital forensics field and the relationships between them. In particular, we concentrate on the Windows Registry, where registry keys are modeled in terms of both their structure and function. Registry analysis software tools are modeled in a similar manner and we illustrate how the interpretation of their results can be done using the reasoning capabilities of ontology.  The rate of computer crime continues to increase year to year. The sophistication of the crimes and the variety of technological devices employed in these offenses are becoming critical challenges to the investigators (Sophos, 2009; U.S. Department of Justice, 2007) . As well as the inherently distributed cyber crimes, such as DOS attacks, low-level cyber crimes involving only a few individuals now typically involve the investigation of multiple devices. Consequently digital investigations are more prolonged, complicated and require the integration of many disparate sources of data. As a result investigators require extensive training in a wide range of software tools, techniques, hardware equipment and digital devices. In addition to being aware of emerging technologies and possible sources of evidence, investigators need also be aware of inaccuracies and applicability of using a particular technique or tool on a particular device for a particular case. Guides are continually being published to advise the investigators on how to investigate a particular device and carry out the investigation effectively (Carvey, 2005; Farmer and Burlington, 2007; Sophos, 2009 ; U.S. Department of Justice, 2007; Wong, 2009 ). The transfer of knowledge to relevant parties is informal and periodic. A central, application and case independent knowledge base that can be continually supplemented with new knowledge can be an invaluable resource of reference to an investigative team. The knowledge base, designed in a logic manner, would reflect the digital forensic field and give structure to an investigation by defining each of the main major concepts and their attributes. Ontologies have been developed for the Semantic Web to give a structure to the seemingly unstructured world of the Internet. They are a ''formal, explicit specification of shared conceptualisation' ' (Gruber, 1995)  This paper presents DIALOG (Digital Investigation Ontology); a framework for the management, reuse, and analysis of Digital Investigation knowledge. DIALOG provides a general, application independent vocabulary that can be used to describe an investigation at different levels of detail. DIALOG is defined to encapsulate all concepts of the digital forensics field and the relationships between them. In particular, we concentrate on the Windows Registry, where registry keys are modeled in terms of both their structure and function. Registry analysis software tools are modeled in a similar manner and we illustrate how the interpretation of their results can be done using the reasoning capabilities of ontology.
Kahvedzic and Kechadi REF have presented a digital investigation ontology as an abstraction of concepts and their relationships for the representation, reuse and analysis of digital investigation knowledge.
DIALOG: A framework for modeling, analysis and reuse of digital forensic knowledge
Digital Investigation Volume 6, Supplement, September 2009, Pages S23-S33
Computer Science