A Digital Forensics Live Suspicious Activity Toolkit To Assist Investigators With Sexual Harm Prevention Order Monitoring

The National Society for the Prevention of Cruelty to Children (NSPCC) and the Internet Watch Foundation (IWF) report a growing number of child sexual abuse material within the UK, substantiated by the National Crime Agency (NCA). This paper will investigate the increasing burden, and time-consuming task placed upon police forces, by the required regular examination of digital devices, belonging to sentenced peadophiles and individuals, bound by a Sexual Harm Prevention Order (SHPO). By examining some of the motivations behind offenders and their desire to habitually offend, and by using the most common traits amongst them, indicators of suspicious behaviour will emerge. In this paper, a proof-of-concept digital forensic investigation toolkit is proposed to assist Public Protection Officers (PPO) in the analysis of digital devices belonging to these individuals. The proposed Live Suspicious Activity Toolkit (LiSA - T) will enable a time-efficient, up to date assessment of any suspicious activity and behaviour on a Windows 10 computer. By using specific modules that can be turned on and off, updated and have unique preferences assigned to them, LiSA-T will evaluate and then report the findings, assisting the PPO with an informed decision as to involve the Digital Forensic Unit (DFU), to further examine a device in a more in-depth forensic manner. The test results, demonstrated that the proposed LiSA- T techniques, showed low computational cost to successfully detect the targeted evidential artifacts for the defined suspicious activity.