GUIDELINES FOR COST-EFFECTIVE GEOVISUALIZATION IN DIGITAL FORENSICS

Every field of our life is influenced by the appearance of new technologies. This means that new challenges keep being met and finding solutions, developing methods to deal with them belong to our tasks. Law enforcement has to be always ready to adopt the achievements of any disciplines. Experts and professionals in any field should be aware of applicability of the knowledge they have that is why it is important to highlight as much fields where our knowledge can be used as we can. Digital forensics differs from traditional forensics in many aspects that is why a general GIS professional can be involved into an investigation easily. This paper aims to provide methods to geovisualize information containing or referring to location data. Cost effective solutions are preferred throughout the paper.


Introduction
Our life immersed in digital technologies has changed considerably.Everything became, becomes or is going to become simpler by using the several innovative features of informatics.You can keep in touch with people living far away for free (by email, Skype, social media, etc.), store, share and look for any kind of information (web portals, digital archives, browsers, search engines, cloud applications), facilitate administration (booking, banking, purchasing, etc.), acquire new skills (by taking online courses, (video) tutorials), control your household appliances (with innovations of internet of things) and the listing could be continued.The volume of influencing our life by digital technologies differs from generation to generation.Generation Z (with birth years starting from the late 1990s) is often called also digital natives, because they are all "native speakers" of the digital language of computers, video games and the internet.They are surrounded by digital appliances since their birth, so their usage is natural for them.Following the track of a plane in internet is as obvious for this generation as picking up a book for their parents.People who were not born into the digital world, but during their life have become committed in adopting new achievements of digital technology are referred as digital immigrants.The nature of the two groups is summarized in the work of Prensky (Prensky 2001).It can be claimed without any doubt that life in the 21st century is strongly influenced by IT.Unfortunately, dark sides of this phenomena have also to be mentioned, because like the physical world, the digital one is also threatened by criminals.
Digital technologies can appear in two different contexts in forensics.Firstly, digital world itself can be the object or a tool of a crime.Rather common form of this is hacking a website (and altering its content), or online interfaces of different applications (online banking, stores) accessed via web browsers.Computer viruses (independently whether they do damage or not) belong to this category as well.
Second context is when the digital world provides us evidences about crimes.In the field of law enforcement GIS is often used for visualization purposes as well as for data analysis (Pődör 2014) or for data acquisition (Pődör 2016).Crime mapping and analysis do not substitute for, but complete to other forms of crime analysis.Our task is to understand characteristics of available information in order to be able to recognize where tools of GIS can support the investigation.While mapping means that hidden information is captured mainly by the investigator based on the visual experience, analysis produces new in-formation that can confirm or deny our hypothesis.In other words, mapping indicates who, what, when, and where, but analysis helps determine why and what it all means (Bruce 2001).
Digital forensics differs from traditional forensics in many aspects.A criminal investigation is conducted by members of law enforcement, but digital forensics may be used to explore data by organizations or individuals as well.Digital forensics is the application of scientific principles to the process of discovering information from a digital device (Gogolin 2013).The complex process is supported by software products, methods, regulations and requires a particular detailed, sometimes exhaustive work.Basically, any digital device can provide data for investigation not only computers (in any form), but printers, cell phones, mobile devices, GPS devices, storage media or other programmable devices.Geographic Information Systems (GIS) can enhance the process of cognitive interpretation of the hidden spatial information by recognizing the geospatial relationship between objects, people, scenes, events, etc. (Zichar 2013).
The basic steps of a digital forensic investigation (Harrington -Cross 2015): • Seizure Obtaining and preserving computers, additional digital devices and/or media.
• Acquisition Data retrieval from devices resulted by the previous step.
• Analysis Examinations of data retrieved in the previous step to answer questions.
• Reporting Creating documentations about the evidentiary findings.
It is mainly the last two stages where a GIS expert can be involved into the investigation, but sometimes acquiring GPS data from a device can provide additional information about a case too.

Simple geovisualization tools for digital forensics
Without professional investigating software it is our task to look for data that can provide us additional information about the activity of the device owner.This section overviews the types of digital information containing geospatial data component and also highlights the methods how to geovisualize them.The order of the listing is determined by the mapping types.The mapping can be classified into two groups with significant differences (Table 1).
Direct mapping means that the data to be visualized are available in a format that can be interpreted (opened) by an appropriate GIS application immediately.In the case of indirect mapping (often time consuming) preprocessing has to be done in order to start the visualization (Zichar 2016).

GPS data
Nowadays, more and more digital devices (such as mobile phones, navigation systems, tablets, etc.) have built-in GPS units which make it possible to determine the current

Geotagged photos
Digital cameras, smart phones and also computers can contain photos with information about the geographical location where they were taken.In practice this means, that at least latitude and longitude are assigned to the image, while additional information such as altitude, track, or compass bearing are only optional.It has to be mentioned that these metadata can be assigned to a picture later as well either automatically or manually.Panorado Flyer is for example a small, but powerful tool for linking geolocation to JPEG image files.If a photo is geotagged, then the details tab in the Properties window of the image contains also a GPS section (Fig. 1).Theoretically, each part of a picture could have information about its geographic location, but usually only the position of the camera is associated with the image, which makes the process of geovisualization simpler.Not only the visual content of the photos but also the geospatial information can reveal new evidences, so it is worth mapping the information.
Google has launched recently a brand new application called PlaNet that is capable of identifying the place a photo was taken even the photo is not geotagged.This very hard task can use only visual features and available textual tags, so a clear, not blurred photo is a requirement.It uses a special neural network based on a grid of approximately 26000 boxes, the team divided the world into.The test results seem convincing although the service is not yet perfect, but can be a powerful tool providing for the investigator.

Geocoding with fusion tables
Digital devices can contain several files referring to geographical locations in different forms.Information can be found in the content of documents, notes, presentations, spreadsheets, etc. and the information itself can be settlements names, names of countries, regions, buildings, organizations, geographical locations, etc. Visualization of them can also highlight important spatial relationship which otherwise remain hidden.Although in case of only a few items the visualization can be performed manually (for example with Google Maps, or Google Earth) usually the number of items is high.The geocoding of large amount of items can be performed with the help of Fusion Tables from Google.Fusion Tables is an experimental data visualization web application to gather, visualize, and share data tables coming from different sources (Zichar 2012a).Making a map takes only a minute if the data are imported into a table, and Figure 2 shows a small table with only one column Location and four rows, while Figure 3 shows the visualized point features in a map.There are many tools to make customization (icons, contents of associated bubble, creating legends, etc.), but their discussion is out of the scope of this paper.The result can be downloaded in file format csv or kml, which ensures further editing options.This free online service is definitely one of the simplest way to visualize large amount of data.

Fig. 1 .
Fig. 1.Metadata of a geotagged photo in the GPS section

Table 1 .
Comparing types of mapping physical location of the device and also to record it.This means that data about the motion of the device holder are available if we can retrieve them through some tool.One of the simplest solution is to use Google Earth (GE) to import data from GPS devices through a direct connection or by importing the files themselves acquired from a device.GE is ready immediately to show the data on the virtual globe.