To read this content please select one of the options below:

Forensic triage of email network narratives through visualisation

John Haggerty (School of Computing, Science and Engineering, University of Salford, Salford, Greater Manchester, UK)
Sheryllynne Haggerty (School of Humanities, University of Nottingham, Nottingham, UK)
Mark Taylor (School of Computing and Mathematical Sciences, Liverpool John Moores University, Liverpool, UK)

Information Management & Computer Security

ISSN: 0968-5227

Article publication date: 7 October 2014




The purpose of this paper is to propose a novel approach that automates the visualisation of both quantitative data (the network) and qualitative data (the content) within emails to aid the triage of evidence during a forensics investigation. Email remains a key source of evidence during a digital investigation, and a forensics examiner may be required to triage and analyse large email data sets for evidence. Current practice utilises tools and techniques that require a manual trawl through such data, which is a time-consuming process.


This paper applies the methodology to the Enron email corpus, and in particular one key suspect, to demonstrate the applicability of the approach. Resulting visualisations of network narratives are discussed to show how network narratives may be used to triage large evidence data sets.


Using the network narrative approach enables a forensics examiner to quickly identify relevant evidence within large email data sets. Within the case study presented in this paper, the results identify key witnesses, other actors of interest to the investigation and potential sources of further evidence.

Practical implications

The implications are for digital forensics examiners or for security investigations that involve email data. The approach posited in this paper demonstrates the triage and visualisation of email network narratives to aid an investigation and identify potential sources of electronic evidence.


There are a number of network visualisation applications in use. However, none of these enable the combined visualisation of quantitative and qualitative data to provide a view of what the actors are discussing and how this shapes the network in email data sets.



Haggerty, J., Haggerty, S. and Taylor, M. (2014), "Forensic triage of email network narratives through visualisation", Information Management & Computer Security, Vol. 22 No. 4, pp. 358-370.



Emerald Group Publishing Limited

Copyright © 2014, Emerald Group Publishing Limited

Related articles