Change detection in semi-structured documents

Abstract

In digital forensics investigations it is sometimes required to sift and analyse a large number of documents handed in as evidence. A computer system can aid an investigator to establish the exact derivation of changes in a pair of documents by summarising changes into separate categories, such as insertions and deletions. Traditionally, this had to be done with diff utilities that cannot understand the hierarchical structure of an XML document, and can often detect the wrong changes. This approach is cumbersome, and the investigator must perform several pre- and postprocessing steps to ensure accurate derivation of changes. This project targets documents encoded in the Office Open XML .docx format, the default file format of Microsoft Word, and assumes that the documents contain text and track change annotations. A tool is developed, called DocxDiff, that is easy to use and requires minimal user interaction. It uses a change detection algorithm that is specifically designed to work with XML documents and provides accurate delta. DocxDiff ignores irrelevant deltas, such as nodes that are represented differently, but semantically equivalent. With the help of XPaths, it only inspects nodes that have changed without the need to wholly traverse the document tree. DocxDiff encapsulates the delta and presents any altered track change state to the investigator in an easy to interpret summary of changes. The investigator is expected to use this summary to determine whether to shortlist the documents for further analysis. DocxDiff achieved a very good track change detection accuracy and changes are always classified in the right category.