Measuring the effectiveness of keyword lists in digital forensics

Keyword searching is fundamental to digital forensics and therefore there is a clear need to validate results. This paper demonstrates an approach that can be used to measure the effectiveness of generic wordlists used for specific crime types (e.g. drugs, child abuse, terrorism) that complement specific keywords chosen for individual cases. This approach allows measurement of error associated with this use of case-type based wordlists, and facilitates development of a new research area in digital forensics: optimising keyword lists. The paper demonstrates this experimentally and shows that this important technique can now be evaluated in a scientific manner and concludes with a proposed implementation for deploying this within a forensic lab.