The Computer Forensics Architecture enables recursive
processing of evidence data in order to
extract any embedded unstructured text content into an indexable form
and to extract potentially interesting metadata from the evidence data.
This with the goal to give
the tactical investigator the opportunity to search through cases
finding clues.
The router fulfills a core task in routing the evidence through the desired chain of
modules in order to extract all the necessary metadata and indexable text data.
In order to determine how to route evidence data, the router looks at the metadata added to the evidence by previous modules. This enables the router to guide the evidence through the desired chain of modules in order to extract any useful metadata and derive sub content evidences. The router uses a user defined rulelist to determine which module type is needed next to process the current evidence.