forensics; declarative queries

ABSTRACT

Digital forensics often requires an investigator to use multiple tools in the anal- ysis phase. For example, the output of a tool may be captured into a file that is then input to a second tool; values may be printed and manually entered in subsequent phases of analysis. This process is tedious, adhoc and time consum- ing.