Abstract

The primary intent of this thesis is to contribute to cyber forensics by addressing two important aspects that are processes and analysis techniques. In this thesis, first, the existing proposals of cyber forensic processes are compiled and evaluated according to a priori, well-defined criteria. Beside this evaluation, a new digital forensic process is developed that uses the high potential of the previous proposals and addresses their identified deficiencies. In addition, a new technique of e-mail evidence investigation is presented to be used in cyber forensics analysis. The proposed technique extensively uses and exploits data mining techniques for answering several important questions that are extremely relevant in a forensic setting, such as e-mail clustering, classification, social network computation and the author identification of anonymous e-mails. Finally, towards this objective, the architecture and the design of an environment are also elaborated that implement the aforementioned technique.