An Ontology for Digital Forensics in IT Security Incidents - OPUS

70 CHAPTER 9. SUMMARY
after some issue occurred.
Using the ontology to investigate the cases made it easier because only
queries had to be issued. For example, for the Autorun query the printkey
module of volatility needs to be run multiple times to get the data from the
registry in the memory. For the registry on the hard disk it is rst needed
to know where the relevant les are located and then extract them with icat
from The Sleuth Kit if the source is an image and then run reglookup for each
of them. All this is simplied to only issuing one query because all other
commands have been run automatically during the extraction process.
In my opinion the ontological approach has great potential because it
makes forensic analysis easier. An additional aspect is that after the database
is lled, multiple investigators can use this data and do not need to run the
same tools again.
The creation of the ontology is not that easy as the tools do not create
satisfying RDFS les or are uncomfortable to use. If the forensic ontology
is to be developed further, it may be useful to create a tool that allows an
easier creation of RDFS les of similar structure. Additionally, a program
should be developed that makes it easier to parse the output of a forensic
tool and map it to the correct part of the ontology.