Evidence analysis to basis of clustering: Approach based on mobile forensic investigation

Efficiency of mobile investigation process (Smartphone Forensics) is associated with its evidence analysis phase. This phase rests on collection and location of all evidence and their temporal, functional and relational combinations. High volume of these sets evidence, its complexity and size of relations between the different data types may complicate the evidence analysis phase and crime reconstruction. In this paper, we propose a temporal and functional analysis method based on Data mining (unsupervised classification). We introduce a new technique of clustering ascending based on dynamic causality and events reconstruction (SMS and Calls) in time, in this case, we can help an investigator to identify anomalies and information on crime and to provide a global vision of all events through all collected evidences.