An Ontology for Digital Forensics in IT Security Incidents - OPUS

58 CHAPTER 7. IMPLEMENTATION
the complete registry tree is retrieved. The problem about this approach is
that the printkey function calls take longer time with the depth of the key
in the tree. In tests it started with around 30 seconds and went up to over
one minute per call. The registry of the test systems contains between 45000
and 50000 keys. It would take approximately 47500 ∗ 45 seconds = 2137500
seconds ≈ 24, 7 days to extract all keys this way. It did not make it much
better to parallelize the task as it would take 24, 7 days / 8 ≈ 3 days for eight
parallel function calls. The function hivedump prints all keys for a specied
hive and does this faster than 24, 7 days. But it only prints the last write
date and the key and not the sub keys and values.
The solution is to combine the code of both functions to create hivedump2
which lists all keys like the hivedump function but prints the detailed
information of the printkey function. The new function is executed parallel
for all hives the consequence of which is a duration of around two hours for
the extraction of the registry.
7.5 Database
At rst Neo4J [Neo Technology, Inc, 2013] was used for storing the RDF
and RDFS tuples. The database has the advantage of a graphical web front
end which visualizes the nodes and their connections. When later in the
implementation the registry data was added this front end was very slow.
This is no big problem as the database only has to answer queries. But the
database was also very slow or did not respond at all.
After this problem Neo4J was replaced by the Sesame framework[Aduna,
2012]. The database of Sesame is much faster and allows SPARQL queries
from the web front end what makes developing new queries easier. The query
that did not respond in Neo4J returned a result after 100ms. In the current
version of the Java program the user can select which database should be
used.
7.6 SPARQL
The creation of queries to retrieve information from the database is exempli-
ed with a query that nds a specic le name, a query that lists all values
of the autorun keys in the registry and a query that nds processes that have
no parent or only themselves. At all listed queries the prex shown in listing
7.2 is omitted to make them easier to view and to save space.
7.6.1 Find File
A rst try is to use the query from listing 7.3. The result should be the
File Name entry of the specied le. In line one the variable ?file is spec-