System and method for extracting causal relationship configuration information from multimodal digital evidence file

Abstract

This method for extracting causal relationship configuration information from a multimodal digital evidence file comprises the steps of: analyzing content included in a digital evidence file collected for a criminal case and changing the content into a form of a structured text; inputting the structured text to a pre-trained language model for analysis of the digital evidence file; and outputting causal relationship configuration information for the criminal case from the language model in response to the input.

Description

System and method for extracting causal relationship information from multimodal digital evidence files

[0001] The present invention relates to a system and method for extracting causal relationship configuration information from a multimodal digital evidence file.

[0002] The advancement of internet services has created a wealth of evidence related to criminal allegations, spanning various digital devices and channels, including social media, SNS, audio recordings, captured documents / websites, and video recordings. While criminal investigators strive to secure all possible evidence through search and seizure, the sheer volume of evidence is overwhelming, requiring a thorough review of all content to determine the specifics of the alleged crime.

[0003] However, it is time-consuming for criminal investigators to manually analyze all the evidence, and the sheer volume of evidence makes it difficult to identify or classify evidence highly relevant to a crime. Therefore, there is a pressing need for technology that automatically identifies evidence relevant to a crime.

[0004] Furthermore, a single piece of evidence can be extremely voluminous, with most of it unrelated to the criminal charges. Even in these cases, technology is needed to automatically identify relevant sections of the evidence.

[0005] In the past, the absence of a defined, homogenized causal relationship information system for extracting key causal information from digital evidence made automatic classification and identification difficult. In other words, there is no systematic method for organizing causal information to enable a three-dimensional analysis of a case by uniformly extracting key clues and causal relationships from digital evidence.

[0006] An embodiment of the present invention provides a system and method for extracting causal relationship composition information from a multimodal digital evidence file, which can effectively perform causal relationship analysis for a crime by extracting words and vocabulary related to the circumstances of a crime from evidence files secured for analysis of the digital evidence file.

[0007] An embodiment of the present invention provides a technology for extracting semantic information by applying a content-based analysis theory optimized for various data types of digital evidence files, and processing named entities according to a causal relationship information system specialized for causal information of digital crimes, thereby extracting important information regarding criminal suspicion hidden within the evidence.

[0008] However, the technical task that this embodiment seeks to achieve is not limited to the technical task described above, and other technical tasks may exist.

[0009] As a technical means for achieving the above-described technical task, a method for extracting causal relationship composition information from a multimodal digital evidence file according to a first aspect of the present invention includes the steps of analyzing content included in a digital evidence file collected for a criminal case and changing it into a structured text format; the step of inputting the structured text into a language model learned in advance for analysis of the digital evidence file; and the step of outputting causal relationship composition information for the criminal case from the language model in response to the input.

[0010] In some embodiments of the present invention, the causal relationship configuration information may include clue information, which is information for specifying key elements in the investigation of the relevant criminal case, and causal relationship information, which is information on causal relationships between elements included in the clue information.

[0011] In some embodiments of the present invention, the step of outputting causal relationship configuration information for the criminal case from the language model in response to the input may include the step of setting the clue information as a node attribute and the causal relationship information as an edge attribute to configure it in the form of a knowledge graph; and the step of visualizing and outputting the causal relationship configuration information through the knowledge graph.

[0012] In some embodiments of the present invention, the step of outputting causal relationship configuration information for the criminal case from the language model in response to the input may output the causal relationship configuration information according to time division information divided into before, during, and after the crime.

[0013] Some embodiments of the present invention may further include a step of masking words corresponding to elements included in causal relationship configuration information for sentences included in at least one of a digital evidence file and an investigation document; and a step of training a language model for analyzing the digital evidence file to predict the masked words.

[0014] In some embodiments of the present invention, the step of analyzing the content contained in the digital evidence file collected for the criminal case and converting it into a structured text format may include the step of analyzing the data type characteristics of the collected digital evidence file; and the step of converting the content of the digital evidence file into a structured text format so as to correspond to the analyzed data type characteristics.

[0015] In some embodiments of the present invention, the step of analyzing the data type characteristics of the collected digital evidence file may analyze the data type characteristics of the collected digital evidence file to be classified into any one of messenger conversation, voice conversation, captured document or web, video record, and financial transaction record.

[0016] In addition, a system for extracting and processing causal relationship composition information from a multimodal digital evidence file according to a second aspect of the present invention includes a communication unit for collecting digital evidence files for a criminal case, a memory for storing a program for generating causal relationship composition information for a criminal case based on the collected digital evidence files, and a processor for analyzing content stored in the digital evidence file and transforming it into a structured text format by executing the program stored in the memory, and inputting the structured text into a language model learned in advance for analysis of the digital evidence file to output causal relationship composition information for the criminal case.

[0017] In some embodiments of the present invention, the processor may output causal relationship configuration information including clue information, which is information for specifying key elements in the investigation of the corresponding criminal case, and causal relationship information, which is information on causal relationships between elements included in the clue information.

[0018] In some embodiments of the present invention, the processor may configure the clue information as a node attribute and the causal relationship information as an edge attribute to form a knowledge graph, and may visualize and output the causal relationship configuration information through the knowledge graph.

[0019] In some embodiments of the present invention, the processor may output the causal relationship configuration information according to temporal distinction information that is divided into before, during, and after the crime in the crime case.

[0020] In some embodiments of the present invention, the processor may analyze data type characteristics of the collected digital evidence file and transform the contents of the digital evidence file into a structured text form to correspond to the analyzed data type characteristics.

[0021] In addition, other methods for implementing the present invention, other systems, and computer-readable recording media recording a computer program for executing the above methods may be further provided.

[0022] According to one embodiment of the present invention described above, a causal relationship information system can be utilized to analyze digital evidence and automatically extract key criminal information and clues. This reduces the burden of manually analyzing all evidence and allows for the quick identification of important information that might otherwise be overlooked.

[0023] Additionally, by automatically analyzing clues using a standardized information system, investigative information can be homogenized and consistent, allowing all investigators, regardless of their investigative experience, to identify and analyze information using the same system.

[0024] In addition, by utilizing the extracted information, only evidence highly relevant to the criminal investigation can be automatically identified and classified, enabling rapid classification of evidence and identification of information relevant to the case even with a small number of investigators.

[0025] The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

[0026] FIG. 1 is a flowchart of a method for extracting causal relationship configuration information from a multimodal digital evidence file according to one embodiment of the present invention.

[0027] FIG. 2 is a diagram illustrating an example of an analysis technique applicable depending on the type of digital evidence file in one embodiment of the present invention.

[0028] FIG. 3 is a diagram illustrating an example of causal relationship configuration information defined in one embodiment of the present invention.

[0029] Figure 4 is a diagram for explaining the learning process of a language model in one embodiment of the present invention.

[0030] Figure 5 is a diagram for explaining the process of applying a language model in one embodiment of the present invention.

[0031] Figure 6 is a block diagram of a causal relationship configuration information extraction processing system according to one embodiment of the present invention.

[0032] The advantages and features of the present invention, and the methods for achieving them, will become clearer with reference to the embodiments described in detail below together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various different forms. These embodiments are provided solely to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the present invention, and the present invention is defined solely by the scope of the claims.

[0033] The terminology used herein is for the purpose of describing embodiments only and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise. As used herein, the terms "comprises" and / or "comprising" do not exclude the presence or addition of one or more other components in addition to the mentioned components. Like reference numerals refer to like components throughout the specification, and "and / or" includes each and any combination of one or more of the mentioned components. Although "first", "second", etc. are used to describe various components, these components are not limited by these terms. These terms are only used to distinguish one component from another. Therefore, it should be understood that a first component mentioned below may also be a second component within the technical spirit of the present invention.

[0034] Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used in their common sense to those skilled in the art to which the present invention pertains. Furthermore, terms defined in commonly used dictionaries are not to be interpreted ideally or excessively unless explicitly and specifically defined otherwise.

[0035] The present invention relates to a system and method for extracting causal relationship configuration information from a multimodal digital evidence file.

[0036] In the past, domestic prosecutors and police lacked a formal causal information system for extracting meaningful clues from digital evidence during digital crime investigations. To address this, one embodiment of the present invention proposes a standardized causal information system for examining causal relationships among digital evidence. This system allows for the extraction of information from digital evidence through natural language processing, categorizing it by entity, and producing homogenized results.

[0037] In addition, in the case of conventional technology, due to the absence of a causal information system, it was impossible to extract key clues and causal information for each crime from digital evidence in a homogenized manner. However, by utilizing the causal information system according to one embodiment of the present invention, information extracted from digital evidence can be organized in a homogenized form, and through this, key information necessary for detailed criminal investigation can be accurately extracted.

[0038] Furthermore, prior art techniques have limited the application of extracted information and difficulty in secondary comprehensive inference, limiting detailed criminal investigations. However, one embodiment of the present invention utilizes secondary comprehensive inference on extracted, homogenized information to identify key aspects and evidence of a crime. This enables a variety of applications and enables detailed criminal investigations.

[0039] Furthermore, while prior art has struggled to address the various perspectives crucial to criminal investigations (e.g., the crime flow by time period, such as before, during, and after the crime, and causal relationships), one embodiment of the present invention allows for the processing of crime flow and causal relationships by time period, taking various perspectives into account when organizing information. This allows investigators to secure more systematic and comprehensive information.

[0040] Hereinafter, a system (100) and method for extracting causal relationship configuration information from a multimodal digital evidence file according to one embodiment of the present invention will be described with reference to FIGS. 1 to 6.

[0041] FIG. 1 is a flowchart of a method for extracting causal relationship configuration information from a multimodal digital evidence file according to one embodiment of the present invention.

[0042] Meanwhile, each step illustrated in FIG. 1 may be understood to be performed by the causal relationship configuration information extraction processing system (100) described below, but is not necessarily limited thereto.

[0043] First, the content contained in the digital evidence file collected for the criminal case is analyzed and changed into a structured text format (S110).

[0044] FIG. 2 is a diagram illustrating an example of an analysis technique applicable depending on the type of digital evidence file in one embodiment of the present invention.

[0045] In one embodiment, the present invention can analyze data type characteristics of collected digital evidence files and change the contents of the digital evidence files into a structured text format to correspond to the analyzed data type characteristics.

[0046] In one embodiment, the data type characteristics of the digital evidence file collected in the present invention are as shown in Table 1 below.

[0047] Evidence TypeMain CharacteristicsInformation TypeMessengerThere are more than 1 million conversation records per personText(conversation, abbreviation, etc.)EmailThere are many duplicate emails such as receipt, reference, and blind referenceTextDocumentMost of them are files unrelated to the case, so classification and extraction take too much timeText, ImageAudioFileA lot of time is required for identification and confirmationAudioCaptured web / documentThere is no automated analysis method, so manual verification is requiredText, included Image

[0048] For example, the present invention extracts text information from messenger conversations for each individual or group, and can extract key conversation partners, dates, times, and conversation contents from the conversations. The extracted information is then converted into structured text. In the case of email, information such as recipients, references, and blind references for each email is extracted. Text information can be extracted by analyzing the email body and attachments, and the extracted information is then converted into structured text.

[0049] In the case of documents, most files may be unrelated to the incident. In this case, additional filtering can be performed to identify crime-related documents. This process involves extracting textual information within the documents, converting images within the documents to text or extracting text embedded in images, and converting the extracted information into structured text. For messenger conversations or emails, deep learning text analysis, non-standard language identification, conversation context analysis, and positive / negative sentiment analysis techniques can be applied.

[0050] For audio files, the speaker can be identified, the spoken content verified, and then converted into text for extraction. The extracted information is then converted into structured text. For audio files, techniques such as STT, speaker recognition, deep learning text analysis, and conversation context analysis can be applied.

[0051] For captured web pages and documents, text information can be extracted by analyzing their content, text can be extracted from images, and the extracted information can be converted into structured text. Techniques such as OCR analysis, object recognition, deep learning text analysis, and keyword analysis can be applied to captured web pages and documents.

[0052] In addition, for financial transaction records, financial information is extracted from digital evidence files, including text information related to financial transaction details, transaction time and date, counterparty, transaction amount, transaction notes, transaction region, and transaction type, and the extracted information is converted into structured text format.

[0053] In other words, one embodiment of the present invention utilizes analysis techniques and tools specific to each type of digital evidence file to analyze the contents of the relevant evidence file and extract textual information. This allows the information contained in the evidence file to be converted into structured text format for natural language processing, which can then be utilized to extract causal information.

[0054] Next, structured text is input into a pre-trained language model for analysis of digital evidence files (S120), and causal relationship composition information for a criminal case is output from the language model in response to the input (S130).

[0055] FIG. 3 is a diagram illustrating an example of causal relationship configuration information defined in one embodiment of the present invention.

[0056] In one embodiment, the causal relationship configuration information includes clue information, which is an element for specifying a key element in the investigation of the relevant criminal case, and causal relationship information, which is information on the causal relationship between elements included in the clue information.

[0057] Clue information can consist of various pieces of information, such as people, locations, methods of crime, and transaction methods. For example, clues can include information about the perpetrator and victim, the location of the crime, the method of crime, and the transaction target.

[0058] Causal information shows how one clue influences another, and can be used to infer, for example, a causal relationship between a violent situation and the perpetrator, a causal relationship between an extortion situation and the target of a transaction, or a causal relationship between a crime plan and the result of the crime.

[0059] Here, one embodiment of the present invention can represent clues and causal relationships extracted from a language model based on causal relationship configuration information in the form of a knowledge graph. This can enable a three-dimensional analysis of the case by setting the clue information as a node attribute and the causal relationship information as an edge attribute. Through this knowledge graph, information can be configured to categorize the criminal case by time, including the motive for the crime, premeditation, and accomplice relationship, and to identify the specificity of the crime and the final result. In particular, one embodiment of the present invention outputs causal relationship configuration information according to the temporal categorization information divided into before, during, and after the crime, thereby enabling analysis of the prior conspiracy, the specificity of the crime, and the final result of the crime, thereby enabling confirmation of the progress of the crime by time period.

[0060] Figure 4 is a diagram for explaining the learning process of a language model in one embodiment of the present invention.

[0061] Once converted into structured text format, a pre-trained language model specialized for analyzing digital evidence files must be built to fully extract the information defined in the causal relationship configuration information.

[0062] At this time, one embodiment of the present invention uses a pre-trained language model optimized for a specific purpose, which is already trained in advance with a large amount of general data, and is improved into a model specialized for a specific purpose by additionally learning crime-related information on the training data.

[0063] In one embodiment, the present invention can apply Pol-Robust-BERT as a language model. The Pol-Robust-BERT-based language model is a BERT language model specialized for analyzing digital evidence files, enabling better understanding and processing of crime-related textual information.

[0064] At this time, digital evidence converted into structured text is input to the language model's input stage. The data used as input may consist of masked sentences or words. For example, the masked form may be configured to obscure specific characters, such as the name of a person or a place, within the sentence.

[0065] When structured text is input into a language model, the language model can understand the context of the sentence and predict masked sentences or words to complete the sentence. The output of the language model is a Masked Language Model, which can provide prediction results for masked words within a given sentence. This output can be used to extract clues defined in the causal relationship structure and named entities corresponding to the causal relationship.

[0066] Figure 5 is a diagram for explaining the process of applying a language model in one embodiment of the present invention.

[0067] Afterwards, when digital evidence in the form of structured text is input into a language model that has completed pre-training, causal relationship information regarding a criminal incident can be output in response to the input.

[0068] In addition, one embodiment of the present invention can provide causal relationship composition information according to temporal distinction information when providing causal relationship composition information through a pre-learned language model, and for this purpose, linkage analysis between multiple digital evidence files can be applied.

[0069] Specifically, the first crime-related time is extracted from the first digital evidence file for a crime case. This time can be extracted by analyzing metadata such as the file's creation date, modification date, and last access date, or by using text mining techniques to detect weather and time-related expressions to extract time information.

[0070] This process is performed on n digital evidence files to extract n crime-related times.

[0071] Next, n crime-related time periods are arranged chronologically to generate time information for each crime. This generated time information is not categorized as before, during, or after the crime.

[0072] One embodiment of the present invention can classify the time of a criminal incident into before, during, and after a criminal act through analysis of named entities such as words and vocabulary, but can also compare the minimum criminal execution time for each criminal act to provide faster classification results.

[0073] The minimum time for each criminal act is set for each of the minimum times before, during, and after the criminal act, and the time for the criminal act can be distinguished so that it exceeds each set minimum time by matching the time information of n crime-related times sorted in chronological order.

[0074] While this classification information may not be precise, it allows for quick and rough classification. By integrating this result with the temporal classification results from the aforementioned named entity analysis, causal relationship composition information can be output based on more accurate and rapid temporal classification information. This can provide various benefits, such as faster analysis of massive digital evidence files, leading to faster investigation direction and prevention of further damage through rapid analysis of criminal activity.

[0075] Meanwhile, in the above description, steps S110 to S130 may be further divided into additional steps or combined into fewer steps, depending on the implementation of the present invention. Furthermore, some steps may be omitted as needed, and the order of the steps may be changed. Furthermore, even if other details are omitted, the details described in FIGS. 1 to 5 also apply to the causal relationship configuration information extraction processing system (100) of FIG. 6.

[0076] Hereinafter, a causal relationship configuration information extraction processing system (100) according to one embodiment of the present invention will be described with reference to FIG. 6.

[0077] Figure 6 is a block diagram of a causal relationship configuration information extraction processing system (100) according to one embodiment of the present invention.

[0078] A causal relationship configuration information extraction processing system (100) according to one embodiment of the present invention includes a communication module (110), a memory (120), and a processor (130).

[0079] The communication module (110) collects digital evidence files for criminal cases. Such a communication module (110) may include both a wired communication module and a wireless communication module. The wired communication module may be implemented as a power line communication device, a telephone line communication device, a cable home (MoCA), Ethernet, IEEE1294, an integrated wired home network, and an RS-485 control device. In addition, the wireless communication module may be configured as a module for implementing functions such as WLAN (wireless LAN), Bluetooth, HDR WPAN, UWB, ZigBee, Impulse Radio, 60GHz WPAN, Binary-CDMA, wireless USB technology, wireless HDMI technology, and other 5G (5th generation communication), LTE-A (long term evolution-advanced), LTE (long term evolution), and Wi-Fi (wireless fidelity).

[0080] The memory (120) stores a program for generating causal relationship information for a criminal case based on collected digital evidence files, and the processor (130) executes the program stored in the memory (120). Here, the memory (120) is a general term for a non-volatile storage device and a volatile storage device that maintain stored information even when power is not supplied.

[0081] For example, the memory (120) may include NAND flash memory such as a compact flash (CF) card, a secure digital (SD) card, a memory stick, a solid-state drive (SSD), and a micro SD card, a magnetic computer storage device such as a hard disk drive (HDD), and an optical disc drive such as a CD-ROM or DVD-ROM.

[0082] The processor (130) analyzes the contents stored in the digital evidence file by executing the program stored in the memory (120), transforms it into a structured text format, and inputs the structured text into a language model learned in advance for analysis of the digital evidence file to output causal relationship composition information for the criminal case.

[0083] The above-described program may include codes coded in a computer language, such as C, C++, JAVA, or machine language, that can be read by the processor (CPU) of the computer through the device interface of the computer, so that the computer reads the program and executes the methods implemented as a program. Such codes may include functional codes related to functions that define functions necessary for executing the methods, and may include control codes related to execution procedures necessary for the processor of the computer to execute the functions according to a predetermined procedure. In addition, such codes may further include memory reference-related codes regarding which location (address address) of the internal or external memory of the computer should reference additional information or media necessary for the processor of the computer to execute the functions. In addition, if the processor of the computer needs to communicate with any other computer or server located remotely in order to execute the functions, the code may further include communication-related code regarding how to communicate with any other computer or server located remotely using the communication module of the computer, and what information or media to send and receive during communication.

[0084] The above storage medium refers to a medium that stores data semi-permanently and can be read by a device, rather than a medium that stores data for a short period of time, such as a register, cache, or memory. Specifically, examples of the storage medium include, but are not limited to, ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage device. That is, the program can be stored in various recording media on various servers that the computer can access or in various recording media on the user's computer. In addition, the medium can be distributed across network-connected computer systems, so that computer-readable code can be stored in a distributed manner.

[0085] The steps of a method or algorithm described in connection with an embodiment of the present invention may be implemented directly in hardware, implemented as a software module executed by hardware, or implemented by a combination thereof. The software module may reside in a random access memory (RAM), a read only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, a hard disk, a removable disk, a CD-ROM, or any other form of computer-readable recording medium well known in the art to which the present invention pertains.

[0086] While the embodiments of the present invention have been described above with reference to the attached drawings, those skilled in the art will appreciate that the present invention can be implemented in other specific forms without altering the technical concept or essential features thereof. Therefore, the embodiments described above should be understood to be illustrative in all respects and not restrictive.

Claims

1. In a method performed by a computer, A step of analyzing the contents contained in digital evidence files collected for a criminal case and converting them into structured text format; A step of inputting the structured text into a pre-trained language model for analysis of a digital evidence file; and Including a step of outputting causal relationship configuration information for the criminal case from the language model in response to the input. A method for extracting causal relationship information from multimodal digital evidence files.

2. In paragraph 1, The above causal relationship configuration information includes clue information, which is information for specifying key elements in the investigation of the relevant criminal case, and causal relationship information, which is information on the causal relationship between elements included in the clue information. A method for extracting causal relationship information from multimodal digital evidence files.

3. In paragraph 2, The step of outputting causal relationship composition information for the crime incident from the language model in response to the above input is: A step of configuring the above clue information as a node attribute and the above causal relationship information as an edge attribute in the form of a knowledge graph; and Including a step of visualizing and outputting the causal relationship configuration information through the above knowledge graph. A method for extracting causal relationship information from multimodal digital evidence files.

4. In paragraph 1, The step of outputting causal relationship composition information for the crime incident from the language model in response to the above input is: The causal relationship composition information is output according to the temporal division information divided into before, during, and after the crime. A method for extracting causal relationship information from multimodal digital evidence files.

5. In paragraph 1, A step of masking words corresponding to elements included in causal relationship configuration information for sentences included in at least one of digital evidence files and investigative documents; and Further comprising a step of training a language model for analyzing the digital evidence file to predict the masked word, A method for extracting causal relationship information from multimodal digital evidence files.

6. In paragraph 1, The step of analyzing the contents contained in the digital evidence file collected for the above crime case and converting it into a structured text format is as follows: A step of analyzing the data type characteristics of the collected digital evidence file; and Comprising a step of transforming the contents of the digital evidence file into a structured text format to correspond to the analyzed data type characteristics, A method for extracting causal relationship information from multimodal digital evidence files.

7. In paragraph 6, The step of analyzing the data type characteristics of the above collected digital evidence files is: The above collected digital evidence files are analyzed for data type characteristics classified as messenger conversations, voice conversations, captured documents or web, video records, and financial transaction records. A method for extracting causal relationship information from multimodal digital evidence files.

8. The Communications Department collects digital evidence files for criminal cases; A memory storing a program for generating causal relationship information for a criminal case based on the collected digital evidence files, and By executing the program stored in the above memory, a processor is included that analyzes the contents stored in the above digital evidence file, transforms them into a structured text format, and inputs the structured text into a language model learned in advance for analysis of the digital evidence file to output causal relationship composition information for the above criminal case. A system for extracting and processing causal relationship information from multimodal digital evidence files.

9. In paragraph 8, The above processor outputs causal relationship configuration information including clue information, which is information for specifying key elements in the investigation of the relevant criminal case, and causal relationship information, which is information on causal relationships between elements included in the clue information. A system for extracting and processing causal relationship information from multimodal digital evidence files.

10. In paragraph 9, The above processor sets the clue information as a node attribute, sets the causal relationship information as an edge attribute, configures it in the form of a knowledge graph, and visualizes and outputs the causal relationship configuration information through the knowledge graph. A system for extracting and processing causal relationship information from multimodal digital evidence files.

11. In paragraph 8, The above processor outputs the causal relationship configuration information according to the temporal distinction information divided into before, during, and after the crime in the above crime case. A system for extracting and processing causal relationship information from multimodal digital evidence files.

12. In paragraph 8, The processor analyzes the data type characteristics of the collected digital evidence file and transforms the contents of the digital evidence file into a structured text format to correspond to the analyzed data type characteristics. A system for extracting and processing causal relationship information from multimodal digital evidence files.

Images