An Ontology for Digital Forensics in IT Security Incidents - OPUS

8 CHAPTER 1. INTRODUCTION
data leads to nding evidence and gathering specic additional information
later on.
Another point that has changed is that much evidence can only be
found on live systems. Caused by the fact that a live system runs on,
some information might vanish which complicates the retrieval of additional
facts.[Adelstein, 2006]
But the person who has to acquire a computer as evidence does not
necessarily know that there is volatile data and how to seize it correctly.
In [National Institute of Justice (U.S.), 2004] it is mentioned that evidence
can be volatile but in the chapter about acquisition it is assumed that the
computer is powered o prior to the examination.
Another problem is that the tools built for helping forensic analysts and
investigators do not always work as they are supposed to. Some of them
can be convinced to work together, but there are only few standards for
exchanging data. Many of the tools are developed from scratch. This leads
to the problem that similar program parts are developed multiple times
whereas the used eort could be used more productively.[Garnkel, 2010]
Caused by the fact that researchers develop new tools for the eld they
are procient with, the resulting products are made only for this purpose.
As a result there are plenty of tools an investigator has to be able to use for
solving a single case. And the output of one tool needs to be adjusted to be
compatible to another tool. An additional problem is that new techniques are
developed and presented but without a fully working implementation[Tang
and Daniels, 2005].
This work introduces an ontology for forensic analysis. By using the ontology
the output of tools can be put to one place like in traditional databases
but furthermore it allows to automatically draw conclusions about the correlation
of the single results.
The topic for this work was issued by Siemens CERT Munich. At rst
an ontology that represents the forensically interesting parts of a computer
had to be implemented. As next move an example implementation of a
program had to be built that converts data provided by existing forensic
tools to a format that matches the constraints of the ontology had to be
built. Additionally queries had to be written that allow to nd evidence in
the converted data. Furthermore the functionality needed to be tested on
real malware.