Being able to accurately view and analyze results is an important part of any investigation. Even before the final results stage, however, it can be useful to be able to look at and manipulate different factors within a case, so as to work out where it might be necessary to drill down further, and to uncover correlations that otherwise may be overlooked.

While the primary goal of digital forensics tools is not to look pretty but to uncover, analyze, and report back on data, the visualization process is nonetheless an important part of any software.

A well put together data visualization tool can demonstrate links between contacts, build a timeline and identify potential points of interest along it, bring to light geographical areas that may be relevant to an investigation, and give basic statistical outputs that can lead an investigator to understand which steps should be taken next, among other things.

In this chapter, we will be looking at data visualization techniques and options in three forensic suites. First, we will look at AccessData's FTK and how it reports visually on important areas for investigation. We will then go through open-source freeware Autopsy and discuss how to create a timeline. Finally, we will take a look at Nuix's suite of forensic tools, including their new Web Review & Analytics add-on which sits on top of Nuix Investigator Lab.