ForClu

Forensic Clustering

With photo- and video-capable devices in the hands of a majority of the population worldwide, the amount of media data stored on these devices keep growing. At the same time, the basic findings in the evidence stay the same. As a result, critical evidence might literally be hidden in plain sight, among an overwhelming number of images.

ForClu automatically arranges contents seized from a suspect’s device into meaningful clusters, working with 100.000+ files at the same time. It analyses data, for example pictures, using an artificial neural network, to generate mathematical “concepts” of the pictures. Those concepts are used in arranging them into clusters (e.g. all pictures of vehicles, divided further into cars, busses, motorcycles, bicycles, etc.), which solely depend on the input data.

ForClu

ForClu2

The use of ForClu not only lets you handle big amounts of data at once, it also allows you to create filters for very specific contents, such as details of clothing of a person or a specific build and color of a car you are looking for.

Upcoming features include the possibility to share filters, to help deal with privacy issues within a government agency or even between different agencies. The filters are highly abstracted, so no actual pictures can be retrieved from them.

ForClu can be used as a standalone toolkit, but integration into LEAP’s workflow is planned, and integration into existing forensic toolkits is being evaluated.