Social Network Visualization for Forensic Investigation of E-mail

E-mail features as a key technology for both the dissemination of information and for social networking. Given the volume of e-mail transmission combined with access opportunities, it is not surprising that e-mails feature heavily during a digital forensics investigation. In these investigations, forensic examiners require an understanding of the social networks to which the suspect belongs for both analyzing the event(s) under investigation and to further exploit potential sources of evidence or other suspects. This paper makes use of visual analytic and social network techniques for digital forensics investigations involving e-mail. We present a novel approach, the E-mail Extraction Tool (EET), for automated visualization of client-based e-mail applications and exploring the social networks that these will reveal to the investigator. The case study presented in the paper demonstrates the applicability of the approach to digital forensics investigations.