An Ontology for Digital Forensics in IT Security Incidents - OPUS

Chapter 3
Goal Forensic Semantic Model
This chapter explains what this work is about. Additionally it introduces
the example that will be used throughout this work.
3.1 Ontology
The goal is to create an ontology, a data store, a program to ll the data store,
and several queries that allow the examiner to obtain conclusive evidence fast
and easily. In the end, only the sources to obtain the data from have to be
selected and the program extracts the necessary information and puts it
into the appropriate structure. After the data was imported into the data
store the examiner can query for evidence. If not marked otherwise the term
ontology stands for the one that is introduced in this work.
It is intended to make the gathering of data and the extraction of evidence
faster and more eectively. One positive side eect of the automatic
importing is that there is no need to know every option of every tool involved,
so even novice users can use the program to gather evidence and
the forensic expert can concentrate on more dicult tasks. Another point
is that multiple users can access the data store so numerous examiners can
work together on one case.
The procedure is mainly intended for the fast examination of cases that
incident response teams have to take care of. A requirement from the ontology
is that it has to be customizable for special needs. This can be relevant
if additional information is required that is not yet represented yet. An example
for this is explained in section 4.2.3.3. The tools that provide the
information collected in the data store have to be interchangeable, what is
another important fact. This allows examiners to use the tools they are
familiar with.
The idea is to build an ontology which represents the forensically interesting
parts of a computer system. Chapter 4 will explain how to extract
which part of information and why they are interesting. The information is
11