Essential Characteristics of Approximate matching algorithms: A Survey of Practitioners Opinions and requirement regarding Approximate Matching (2102.10087v1)

Abstract: Digital forensic investigation has become more challenging due to the rapid growth in the volume of encountered data. It is difficult for an investigator to examine the entire volume of encountered data manually. Approximate Matching algorithms are being used to serve the purpose by automatically filtering correlated and relevant data that an investigator needs to examine manually. Presently there are several prominent approximate matching tools and technique those are being used to assist critical investigation process. However, to measure the guarantees of a tool, it is important to understand the exact requirement of an investigator regarding these algorithms. This paper presents the findings of a closed survey conducted among a highly experienced group of federal state and local law enforcement practitioners and researchers, aimed to understand the practitioner and researcher's opinion regarding approximate matching algorithms. The study provides the baseline attributes of approximate matching tools that a scheme should possess to meet the real requirement of an investigator.