Applying Rough Set Theory for Digital Forensics Evidence Analysis

With the growth of digital crime and the pressing need for strategies to counteract these forms of criminal activities, there is an increased awareness of the importance of digital forensics. However, due to the poor quality or the availability of incomplete information, the evidence gathered from a crime scene may not always be optimal in practical situations. Digital evidence can be present in different kinds of devices and in many different forms, much of which is found in an imprecise format making it very difficult to be analyzed. We propose the use of Rough Set theory for the classification of digital evidence. Rough Set theory is a computational model which is an effective tool for analyzing uncertainty and incomplete information. In this paper, we apply a Rough Set model to two digital forensics datasets proving Rough Set to be a valid tool that can be used for digital forensics investigations. We applied two algorithms for feature selection namely, Recursive feature elimination and Fuzzy Rough feature selection. Additionally, various algorithms such as Support Vector Machine (SVM), Naive Bayes, Decision Tree (J48), Logistic Regression, and Rough Set theory were used for classification. Rough Set when used for both feature extraction and classification gives higher accuracy compared to other algorithms.