\subsection*{Visual Decision-Support for Live Digital Forensics}
The tool presented in this section is a prototype developed in the context of forensic analysis. Specifically the prototype collects relevant core information for live digital forensics and provides visual representations for connections between occurring events, developments over time, and detailed information on specific events \cite{LDF_paper}. The motivation behind the development lies in the need to provide forensic experts with new methods for real-time analysis to support their decision-making process. In the case of forensic analysis, the choice of data to be analyzed is crucial as they can be volatile or non-volatile, raw or pre-processed data or data that can have an impact on the running system.

The choice adopted by the developers was to consider as relevant data such as, system Logs, Process information, Network traffic, File-system activities and copy of modified files. The prototype state of the application does not allow for the uploading of personal data, the only option therefore is to test the application with the data provided within the available code \cite{LDF_github}. From the research paper we can deduce that the data was extracted from an Apple mobile device running iOS 14.5 and that the data extraction was conducted at an earlier stage.
Specifically, the data provided within the code is artificial data created with the aim of simulating a particular use case \cite{jeffbezos_report}, based on a real investigation report, to provide a potential scenario for the prototype and to show a possible use of the tool during forensic investigation activities.

By downloading and starting both the server component and the front-end part of the available code, the screen shown is rendered (figure \ref{fig:ldf}). We can immediately see how the tool comes in the form of a single-page application with the dashboard divided into various views. On the left side we can find the search parameters and interactive filters that can possibly be applied to the visualizations, thus modifying the displayed diagram both by changing the start and end times for the analysis and by including or not the filters. Note that when viewing the filters they act both as buttons, which can be activated or not, but also as a legend. At the top is shown a Bar chart (figure \ref{fig:ldf_overview}) for an overview of all activities with a specific time range brushed, allowing users to quickly perceive when the device has conspicuously high or very low activity, allowing specific selection within the timeline. In the central part of the page instead we find the node link diagram which provides us with insight into the activities of the device during the time window selected in the Overview, if it is selected, or the entire time interval that has been provided within the search parameters. The peculiarity of this view lies in showing different types of nodes at the same time, and at the same time showing the respective links, i.e. the activities that that node has performed, providing a visual indicator of how active or inactive they are, depending on the analysis. Finally, the right side presents three graphs, two of which are scatter plots and one a bar chart, which provide information about network and file system activities and information about file versions. In case a node is selected from the node diagram, this part of the dashboard changes to provide information about the selected node, as shown (figure \ref{fig:ldf_details}).

\begin{figure}[h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/LDF/ldf.png}
    \caption{The rendered page of the application}
    \label{fig:ldf}
\end{figure}

\begin{figure}[h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/LDF/ldf_overview.png}
    \caption{Bar chart}
    \label{fig:ldf_overview}
\end{figure}

\begin{figure}[h]
    \centering
    \includegraphics[scale=.25]{Figures/chapter4/LDF/ldf_details.png}
    \caption{Node details}
    \label{fig:ldf_details}
\end{figure}

In terms of development phases it is clear that the main goal of the development was to provide a tool that was a support for accelerate and improve decision-making for domain experts. From the point of view of data selection we cannot say much since the data used to produce the prototype were artificially produced, even if using a real use case as a reference. As regards the cleaning and conversion phase, the program pipeline correlates the raw data provided. The main reason for this is given by the need to obtain representable connections between processes, file modifications and network communications, not allowed by the simple reading of raw data. No particular information is provided on the process of choosing the display method, however we can prove that one of the main characteristics sought in this case is the interactivity of the display to be shown. The characteristics of the visualizations have been presented previously. However, an important observation is that this is the first case addressed in this work which presents a combination of multiple visualization methodologies, all aimed at a single purpose but each providing a different type of information. All this within a single dashboard without the need to navigate to different pages, like the most modern analysis solutions also provided in other sectors. For the final part of the process, i.e. \emph{feedback and fine-tuning}, we know that the prototype was integrated in a workshop dedicated to forensic professionals and that the results would be used to extend the work produced. To date, however, there are no updates found in new versions of the tool.


The prototype developed and shown in this section is another example of how visualization in the field of cybersecurity has a broader response, allowing it to also range in fields such as forensic analysis. However, as suggested by the authors themselves, the tool should be considered as a tool that supports the initial selection of more specific forensic tools. Considering possible developments for the prototype, useful for inserting it in a real context, it would be interesting to add the possibility of inserting the various data necessary for the analysis through the application itself, so as to be able to change datasets during the same analysis. From a graphic design point of view, however, a possible limitation is given by the choice of the node-link diagram that tends to display only a ``hairball" when the number of nodes is high or when the nodes are highly interconnected, therefore not suitable for certain analyses.


