Forensic triage of email network narratives through visualisation

Purpose – The purpose of this paper is to propose a novel approach that automates the visualisation of both quantitative data (the network) and qualitative data (the content) within emails to aid the triage of evidence during a forensics investigation. Email remains a key source of evidence during a digital investigation, and a forensics examiner may be required to triage and analyse large email data sets for evidence. Current practice utilises tools and techniques that require a manual trawl through such data, which is a time-consuming process. Design/methodology/approach – This paper applies the methodology to the Enron email corpus, and in particular one key suspect, to demonstrate the applicability of the approach. Resulting visualisations of network narratives are discussed to show how network narratives may be used to triage large evidence data sets. Findings – Using the network narrative approach enables a forensics examiner to quickly identify relevant evidence within large email data sets. Within the case study presented in this paper, the results identify key witnesses, other actors of interest to the investigation and potential sources of further evidence. Practical implications – The implications are for digital forensics examiners or for security investigations that involve email data. The approach posited in this paper demonstrates the triage and visualisation of email network narratives to aid an investigation and identify potential sources of electronic evidence. Originality/value – There are a number of network visualisation applications in use. However, none of these enable the combined visualisation of quantitative and qualitative data to provide a view of what the actors are discussing and how this shapes the network in email data sets

The Hermeneutics Of The Hard Drive: Using Narratology, Natural Language Processing, And Knowledge Management To Improve The Effectiveness Of The Digital Forensic Process

In order to protect the safety of our citizens and to ensure a civil society, we ask our law enforcement, judiciary and intelligence agencies, under the rule of law, to seek probative information which can be acted upon for the common good. This information may be used in court to prosecute criminals or it can be used to conduct offensive or defensive operations to protect our national security. As the citizens of the world store more and more information in digital form, and as they live an ever-greater portion of their lives online, law enforcement, the judiciary and the Intelligence Community will continue to struggle with finding, extracting and understanding the data stored on computers. But this trend affords greater opportunity for law enforcement. This dissertation describes how several disparate approaches: knowledge management, content analysis, narratology, and natural language processing, can be combined in an interdisciplinary way to positively impact the growing difficulty of developing useful, actionable intelligence from the ever-increasing corpus of digital evidence. After exploring how these techniques might apply to the digital forensic process, I will suggest two new theoretical constructs, the Hermeneutic Theory of Digital Forensics and the Narrative Theory of Digital Forensics, linking existing theories of forensic science, knowledge management, content analysis, narratology, and natural language processing together in order to identify and extract narratives from digital evidence. An experimental approach will be described and prototyped. The results of these experiments demonstrate the potential of natural language processing techniques to digital forensics

A Quantum of Solace: An Exploratory Mixed Methods Study of Online Support in the Self-Management of Anxiety in HPV Positive Women

The implementation of human papillomavirus (HPV) DNA detection as the primary screening tool for screening and management of cervical intraepithelial neoplasia (CIN) proposed for roll-out in 2019-2020 will diagnose more women as HPV positive than are currently diagnosed with CIN due to the relative differences in prevalence between conditions (Sargent et al. 2008; Peto et al. 2004). At present there is no acceptable treatment for HPV (McRae et al. 2014). Anxiety over positivity (Friedman & Shepeard 2007), stigma (Kim 2012), and uncertainty (Kosenko et al. 2012) may constitute a biographical disruption. The stigmatised nature of HPV mean support from regular channels may be restricted due to fears of social rejection following disclosure (Kosenko et al. 2012; Crandall & Moriarty 1995). Online support might instead be utilised to allow access to disease information and social support. Methods: The study was a mixed methods study based on the follow-up explanations model, involving the administration of an online survey questionnaire (N = 107). Following descriptive data analysis, individuals were recruited for email interviews to describe their lived experiences of HPV positivity (N = 3). These narratives were then analysed using thematic analysis. Findings: Women responding to the questionnaire and the interviews reported anxiety over fears of transmission to loved ones. Interview narratives disclosed themes of anxiety caused by the mismanagement of information (too much/too little, conflicting or given at the wrong moment), uncertainty over viral clearance and residual issues of stigma. Women reported the use of online support to exchange information and experiences and provide emotional support. Conclusions: Both the questionnaire and the interview data indicate that uncertainty, anxiety over cancer development and guilt over transmission constitute a biographical disruption among women aware of their HPV positive status, and that the use of online support may be helpful in managing the uncertainty of HPV positivity

The Listening Shift: Evaluating a Communication-Strategies Training Program for Telepractice Nurses Experiencing Hearing Challenges

Workers who wish to remain employed should be supported in doing so, even if they are experiencing age-related disabilities, such as hearing loss. I aimed to better understand the strategies from which workers with hearing loss might benefit, and how they can be supported in adopting these strategies. To collect rich data, I recruited telepractice nurses who rely on listening to make critical decisions about triaging and health care recommendations. My first research question was: What strategies exist for making telephone speech more intelligible for health care providers and patients with hearing challenges? I performed a scoping review following the Joanna Briggs Institute’s protocol. I identified 11 types of strategies, many of which required cooperation from, and disclosure to, providers’ employers, co-workers, and clients. This led me to consider the public narrative workers associated themselves with when they disclosed. Thus, my second research question was: How do Canadian newspapers portray workers with hearing loss? Through a thematic analysis of newspapers articles on this topic, I found they are predominantly portrayed as striving cheerfully both towards functioning normally and towards differentiating themselves and their hearing loss as unique and positive. To further explore how a subset of adults with hearing loss strive to work with a hearing loss, I developed an online communication-strategies training program tailored to nurses with hearing challenges. I then used a multiple case study to answer the following research question: How do nurses with hearing challenges change in terms of their telephone performance and workplace wellbeing in response to participation in an online communication strategies training program? Results suggested that nurses engaged in a problem-solving process before adopting strategies, and that strategy adoption could positively contribute to their performance. Together, the findings from these studies suggest that strategies exist to enhance the performance of workers with hearing loss, but the process of adopting these strategies can be demanding. Organizations should take steps to proactively support their nurses, health-care providers, and potentially other workers with hearing loss in identifying communication strategies and adapting them to their unique context

A Hybrid Modelling Framework for Real-time Decision-support for Urgent and Emergency Healthcare

In healthcare, opportunities to use real-time data to support quick and effective decision-making are expanding rapidly, as data increases in volume, velocity and variety. In parallel, the need for short-term decision-support to improve system resilience is increasingly relevant, with the recent COVID-19 crisis underlining the pressure that our healthcare services are under to deliver safe, effective, quality care in the face of rapidly-shifting parameters. A real-time hybrid model (HM) which combines real-time data, predictions, and simulation, has the potential to support short-term decision-making in healthcare. Considering decision-making as a consequence of situation awareness focuses the HM on what information is needed where, when, how, and by whom with a view toward sustained implementation. However the articulation between real-time decision-support tools and a sociotechnical approach to their development and implementation is currently lacking in the literature. Having identified the need for a conceptual framework to support the development of real-time HMs for short-term decision-support, this research proposed and tested the Integrated Hybrid Analytics Framework (IHAF) through an examination of the stages of a Design Science methodology and insights from the literature examining decision-making in dynamic, sociotechnical systems, data analytics, and simulation. Informed by IHAF, a HM was developed using real-time Emergency Department data, time-series forecasting, and discrete-event simulation. The application started with patient questionnaires to support problem definition and to act as a formative evaluation, and was subsequently evaluated using staff interviews. Evaluation of the application found multiple examples where the objectives of people or sub-systems are not aligned, resulting in inefficiencies and other quality problems, which are characteristic of complex adaptive sociotechnical systems. Synthesis of the literature, the formative evaluation, and the final evaluation found significant themes which can act as antecedents or evaluation criteria for future real-time HM studies in sociotechnical systems, in particular in healthcare. The generic utility of IHAF is emphasised for supporting future applications in similar domains