A Unified Knowledge Graph to Permit Interoperability of Heterogeneous Digital Evidence

TL;DR

This paper introduces a unified knowledge graph that integrates heterogeneous digital evidence sources, enabling efficient cross-platform querying and enhancing digital investigation capabilities.

Contribution

It presents a novel unified data graph approach that harmonizes diverse digital evidence formats for improved interoperability and investigation efficiency.

Findings

Successful integration of heterogeneous evidence sources

Enhanced querying capabilities across multiple platforms

Improved digital investigation performance

Abstract

The modern digital world is highly heterogeneous, encompassing a wide variety of communications, devices, and services. This interconnectedness generates, synchronises, stores, and presents digital information in multidimensional, complex formats, often fragmented across multiple sources. When linked to misuse, this digital information becomes vital digital evidence. Integrating and harmonising these diverse formats into a unified system is crucial for comprehensively understanding evidence and its relationships. However, existing approaches to date have faced challenges limiting investigators' ability to query heterogeneous evidence across large datasets. This paper presents a novel approach in the form of a modern unified data graph. The proposed approach aims to seamlessly integrate, harmonise, and unify evidence data, enabling cross-platform interoperability, efficient data queries, and improved digital investigation performance. To demonstrate its efficacy, a case study is conducted, highlighting the benefits of the proposed approach and showcasing its effectiveness in enabling the interoperability required for advanced analytics in digital investigations.