Measuring the effectiveness of keyword lists in digital forensics

Aikaterini Kanta; Christopher Hargreaves

doi:10.1007/978-3-032-00635-6_3

Measuring the effectiveness of keyword lists in digital forensics

Aikaterini Kanta^*, Christopher Hargreaves

^*Corresponding author for this work

University of Oxford

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Keyword searching is fundamental to digital forensics and therefore there is a clear need to validate results. This paper demonstrates an approach that can be used to measure the effectiveness of generic wordlists used for specific crime types (e.g. drugs, child abuse, terrorism) that complement specific keywords chosen for individual cases. This approach allows measurement of error associated with this use of case-type based wordlists, and facilitates development of a new research area in digital forensics: optimising keyword lists. The paper demonstrates this experimentally and shows that this important technique can now be evaluated in a scientific manner and concludes with a proposed implementation for deploying this within a forensic lab.

Original language	English
Title of host publication	Availability, Reliability and Security - ARES 2025 International Workshops, Proceedings
Editors	Bart Coppens, Bruno Volckaert, Bjorn De Sutter, Vincent Naessens
Publisher	Springer Nature
Pages	42-59
Number of pages	18
ISBN (Electronic)	9783032006356
ISBN (Print)	9783032006370
DOIs	https://doi.org/10.1007/978-3-032-00635-6_3
Publication status	Published - 9 Aug 2025
Event	International Workshops on Availability, Reliability and Security, held under the umbrella of the 20th International conference on Availability, Reliability and Security, ARES 2025 - Ghent, Belgium Duration: 11 Aug 2025 → 14 Aug 2025

Publication series

Name	Lecture Notes in Computer Science
Volume	15996 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	International Workshops on Availability, Reliability and Security, held under the umbrella of the 20th International conference on Availability, Reliability and Security, ARES 2025
Country/Territory	Belgium
City	Ghent
Period	11/08/25 → 14/08/25

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 16 Peace, Justice and Strong Institutions

Keywords

Datasets
Digital Forensic Science
Digital Forensics
Error Rates
Keyword Lists
Keyword Searching
Validation

Access to Document

10.1007/978-3-032-00635-6_3

Embargoed Document

Keyword_Searching__WSDF_2025_ (3)
Accepted author manuscript (Post-print), 549 KB
Due to publisher’s copyright restrictions, this document is not freely available to download from this website until: 9/08/26

Cite this

Kanta, A., & Hargreaves, C. (2025). Measuring the effectiveness of keyword lists in digital forensics. In B. Coppens, B. Volckaert, B. De Sutter, & V. Naessens (Eds.), Availability, Reliability and Security - ARES 2025 International Workshops, Proceedings (pp. 42-59). (Lecture Notes in Computer Science; Vol. 15996 LNCS). Springer Nature. https://doi.org/10.1007/978-3-032-00635-6_3

@inproceedings{46821202c4114098bf9dfda45410ff08,

title = "Measuring the effectiveness of keyword lists in digital forensics",

abstract = "Keyword searching is fundamental to digital forensics and therefore there is a clear need to validate results. This paper demonstrates an approach that can be used to measure the effectiveness of generic wordlists used for specific crime types (e.g. drugs, child abuse, terrorism) that complement specific keywords chosen for individual cases. This approach allows measurement of error associated with this use of case-type based wordlists, and facilitates development of a new research area in digital forensics: optimising keyword lists. The paper demonstrates this experimentally and shows that this important technique can now be evaluated in a scientific manner and concludes with a proposed implementation for deploying this within a forensic lab.",

keywords = "Datasets, Digital Forensic Science, Digital Forensics, Error Rates, Keyword Lists, Keyword Searching, Validation",

author = "Aikaterini Kanta and Christopher Hargreaves",

note = "Publisher Copyright: {\textcopyright} The Author(s), under exclusive license to Springer Nature Switzerland AG 2025.; International Workshops on Availability, Reliability and Security, held under the umbrella of the 20th International conference on Availability, Reliability and Security, ARES 2025 ; Conference date: 11-08-2025 Through 14-08-2025",

year = "2025",

month = aug,

day = "9",

doi = "10.1007/978-3-032-00635-6\_3",

language = "English",

isbn = "9783032006370",

series = "Lecture Notes in Computer Science",

publisher = "Springer Nature",

pages = "42--59",

editor = "Bart Coppens and Bruno Volckaert and \{De Sutter\}, Bjorn and Vincent Naessens",

booktitle = "Availability, Reliability and Security - ARES 2025 International Workshops, Proceedings",

address = "United Kingdom",

}

Kanta, A & Hargreaves, C 2025, Measuring the effectiveness of keyword lists in digital forensics. in B Coppens, B Volckaert, B De Sutter & V Naessens (eds), Availability, Reliability and Security - ARES 2025 International Workshops, Proceedings. Lecture Notes in Computer Science, vol. 15996 LNCS, Springer Nature, pp. 42-59, International Workshops on Availability, Reliability and Security, held under the umbrella of the 20th International conference on Availability, Reliability and Security, ARES 2025, Ghent, Belgium, 11/08/25. https://doi.org/10.1007/978-3-032-00635-6_3

Measuring the effectiveness of keyword lists in digital forensics. / Kanta, Aikaterini; Hargreaves, Christopher.
Availability, Reliability and Security - ARES 2025 International Workshops, Proceedings. ed. / Bart Coppens; Bruno Volckaert; Bjorn De Sutter; Vincent Naessens. Springer Nature, 2025. p. 42-59 (Lecture Notes in Computer Science; Vol. 15996 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Measuring the effectiveness of keyword lists in digital forensics

AU - Kanta, Aikaterini

AU - Hargreaves, Christopher

N1 - Publisher Copyright: © The Author(s), under exclusive license to Springer Nature Switzerland AG 2025.

PY - 2025/8/9

Y1 - 2025/8/9

N2 - Keyword searching is fundamental to digital forensics and therefore there is a clear need to validate results. This paper demonstrates an approach that can be used to measure the effectiveness of generic wordlists used for specific crime types (e.g. drugs, child abuse, terrorism) that complement specific keywords chosen for individual cases. This approach allows measurement of error associated with this use of case-type based wordlists, and facilitates development of a new research area in digital forensics: optimising keyword lists. The paper demonstrates this experimentally and shows that this important technique can now be evaluated in a scientific manner and concludes with a proposed implementation for deploying this within a forensic lab.

AB - Keyword searching is fundamental to digital forensics and therefore there is a clear need to validate results. This paper demonstrates an approach that can be used to measure the effectiveness of generic wordlists used for specific crime types (e.g. drugs, child abuse, terrorism) that complement specific keywords chosen for individual cases. This approach allows measurement of error associated with this use of case-type based wordlists, and facilitates development of a new research area in digital forensics: optimising keyword lists. The paper demonstrates this experimentally and shows that this important technique can now be evaluated in a scientific manner and concludes with a proposed implementation for deploying this within a forensic lab.

KW - Datasets

KW - Digital Forensic Science

KW - Digital Forensics

KW - Error Rates

KW - Keyword Lists

KW - Keyword Searching

KW - Validation

UR - https://www.scopus.com/pages/publications/105015586150

U2 - 10.1007/978-3-032-00635-6_3

DO - 10.1007/978-3-032-00635-6_3

M3 - Conference contribution

AN - SCOPUS:105015586150

SN - 9783032006370

T3 - Lecture Notes in Computer Science

SP - 42

EP - 59

BT - Availability, Reliability and Security - ARES 2025 International Workshops, Proceedings

A2 - Coppens, Bart

A2 - Volckaert, Bruno

A2 - De Sutter, Bjorn

A2 - Naessens, Vincent

PB - Springer Nature

T2 - International Workshops on Availability, Reliability and Security, held under the umbrella of the 20th International conference on Availability, Reliability and Security, ARES 2025

Y2 - 11 August 2025 through 14 August 2025

ER -