Developing a Process Model for the Forensic Extraction of Information from Desktop Search

Desktop search applications can contain cached copies of files that were deleted from the file system. Forensic investigators see this as a potential source of evidence, as documents deleted by suspects may still exist in the cache. Whilst there have been attempts at recovering data collected by desktop search applications, there is no methodology governing the process, nor discussion on the most appropriate means to do so. This article seeks to address this issue by developing a process model that can be applied when developing an information extraction application for desktop search applications, discussing preferred methods and the limitations of each. This work represents a more structured approach than other forms of current research

Program Understanding in Databases Reverse Engineering

The main argument of the paper is that database understanding requires sophisticated program understanding techniques, and conversely. Database reverse engineering (DBRE) can be carried out following a generic methodology, one of the phases of which consists in eliciting all the implicit and untranslated data structures and constraints. Evidences of these hidden constructs can be found by analysing how the programs are to use and create the data. Hence the need for program analysis techniques such as searching for clichs, dependency analysis, program slicing and synthetic views. The paper explains how these techniques contribute to DBRE, and describes DB-MAIN, a programmable and extensible CASE environment that supports DBRE through program understanding techniques