Development of Digital Evidence Collector and File Classification System with K-Means Algorithm

Digital forensic is a branch of forensic science that focuses on research on the usual storage media that electronic users use such as hard disks, flash drives or other devices used on computers. The output is called digital evidence. The purpose of doing digital forensics is to find an evidence that can be used in the investigation of a case, until the evidence becomes valid and could be used as evidence in court. In this research, we implement a system of digital evidence collection, recovery, and file classification application. The classification was done by K-Means clustering algorithm. The system could detect the storage media, duplicate the content, and classify the output using K-Means algorithm. It can help a forensic examiner in the collection, examination, analysis, and reporting phase in accordance with NIST SP 800–86. The application also can assist investigators in managing files in the storage media as digital evidence so that outputs are obtained in accordance with applicable law.