Visualization of Client-Side Web Browsing and Email Activity

Abstract : Both web browsers and email clients provide records of user activity, the former as part of the history mechanism for revisitation purposes, and the latter as part of each message. Both are highly valuable from a forensic perspective, with elements such as visited site, mail contact, and event timestamp revealing a wealth of information about the user's browsing and communication behavior. The ability of the forensic analyst to quickly and efficiently explore and understand this volume of information and reconstruct the user's online activity is important, and can contribute to the progress of the investigation. The objective of this thesis is the design and construction of a set of tools to transform this textual history into a visual format, thus facilitating the analysis, interpretation and identification of trends and relationships that may exist. The result of transforming textual histories into visual images and presenting them in a single summary report is the effective distillation of large amounts of information into minimal space, thereby enabling the analyst to form a high-level profile of the user who generated the data. This allows him to better understand the user's online activity in the context of the specific investigation, and effectively prioritize his limited time and attention.