Clustering of Documents in Forensic Analysis for Improving Computer Inspection

Abstract: In Forensic Analysis thousands of files are usually examined. Data in those files consists of unstructured text analyzing it by examiners is very difficult. Algorithms for clustering documents can facilitate the discovery of new and useful knowledge from the documents under analysis. Cluster analysis itself is not one specific algorithm but the general task to be solved. It can be achieved by various algorithms that differ significantly in their notion of what constitutes a cluster. Here we propose an approach that applies to clustering of Documents seized in police investigations. We define the proposed approach with K-Means algorithm. Our experiment shows that the performance of computer for inspecting several files is improved. Finally we also present and discuss several practical results that can be useful for researchers and practitioners of forensic computing.

Keywords: Clustering, forensic computing, mining.