%PDF-1.6
%
1 0 obj
<>
endobj
2 0 obj
<>stream
Arafat Al-dhaqm, Shukor Razak, Siti Hajar Othman, Asri Ngadi, Mohammed Nazir Ahmed, Abdulalem Ali Mohammed
Development and validation of a Database Forensic Metamodel (DBFM)
www.plosone.org
www.plosone.org
endstream
endobj
3 0 obj
<>/XObject<>>>/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 10 0 R/Annots 11 0 R/Contents 12 0 R/TrimBox[0 0 612 792]>>
endobj
11 0 obj
[13 0 R 14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R]
endobj
13 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref004)>>
endobj
14 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref005)>>
endobj
15 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref006)>>
endobj
16 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref007)>>
endobj
17 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref008)>>
endobj
18 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref009)>>
endobj
19 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref010)>>
endobj
20 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref011)>>
endobj
21 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref017)>>
endobj
22 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref024)>>
endobj
23 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref012)>>
endobj
24 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref013)>>
endobj
25 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref014)>>
endobj
12 0 obj
[26 0 R 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R]
endobj
26 0 obj
<>stream
q
0.83 0.64 0.02 0 k
461.1969 615.3449 m
465.9591 615.3449 l
h
f*
297.0709 458.9291 m
301.8331 458.9291 l
h
f*
500.9953 458.9291 m
505.7008 458.9291 l
h
f*
507.9685 458.9291 m
512.7307 458.9291 l
h
f*
497.0268 419.9244 m
501.7323 419.9244 l
h
f*
504 419.9244 m
508.7622 419.9244 l
h
f*
227.3386 380.9197 m
236.863 380.9197 l
h
f*
234.4252 224.9008 m
243.9496 224.9008 l
h
f*
270.5953 198.9354 m
280.1197 198.9354 l
h
f*
285.2787 198.9354 m
294.8031 198.9354 l
h
f*
316.9134 185.8961 m
326.4378 185.8961 l
h
f*
368.9008 146.948 m
378.4252 146.948 l
h
f*
380.6929 146.948 m
390.2173 146.948 l
h
f*
0 g
1 j
1 J
0 w
10 0 0 10 200.0125 707.4141 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(structuring)Tj
4.6771 0 Td
(domain)Tj
3.3278 0 Td
(knowledge.)Tj
4.7679 0 Td
(This)Tj
1.9842 0 Td
(study)Tj
2.3924 0 Td
(discusses)Tj
3.8325 0 Td
(the)Tj
1.4683 0 Td
(DBF)Tj
2.0636 0 Td
(domain)Tj
3.3222 0 Td
(from)Tj
2.2053 0 Td
(several)Tj
2.9367 0 Td
(perspec-)Tj
-32.978 -1.3039 Td
(tives)Tj
2.0239 0 Td
(to)Tj
1.0261 0 Td
(highlight,)Tj
4.0365 0 Td
(extract,)Tj
3.1578 0 Td
(compare,)Tj
3.9458 0 Td
(merge)Tj
2.7212 0 Td
(and)Tj
1.7292 0 Td
(derive)Tj
2.6872 0 Td
(common)Tj
3.8437 0 Td
(concepts)Tj
3.7247 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4684 0 Td
(domain)Tj
3.3278 0 Td
(as)Tj
1.0148 0 Td
(well)Tj
-35.7219 -1.2982 Td
(as)Tj
1.0147 0 Td
(to)Tj
1.0262 0 Td
(harmonize)Tj
4.5297 0 Td
(and)Tj
1.7291 0 Td
(reconcile)Tj
3.8551 0 Td
(concepts)Tj
3.7247 0 Td
(and)Tj
1.7292 0 Td
(definitions,)Tj
4.7508 0 Td
(such)Tj
2.0579 0 Td
(as)Tj
1.0148 0 Td
(i\))Tj
0.8277 0 Td
(the)Tj
1.4684 0 Td
(Database)Tj
3.8494 0 Td
(Dimensions)Tj
-31.5777 -1.2983 Td
(perspective;)Tj
4.9265 0 Td
(ii\))Tj
1.0942 0 Td
(Database)Tj
3.8438 0 Td
(Forensic)Tj
3.651 0 Td
(Technology)Tj
4.9379 0 Td
(perspective;)Tj
4.9266 0 Td
(and)Tj
1.7291 0 Td
(iii\))Tj
1.3606 0 Td
(Database)Tj
3.8494 0 Td
(Forensic)Tj
3.6454 0 Td
(Investi-)Tj
-33.9645 -1.2983 Td
(gation)Tj
2.7382 0 Td
(process)Tj
3.1861 0 Td
(perspective.)Tj
-4.7281 -1.3039 Td
(This)Tj
1.9899 0 Td
(study)Tj
2.3867 0 Td
(applies)Tj
2.9877 0 Td
(a)Tj
0.6577 0 Td
(metamodelling)Tj
6.2418 0 Td
(approach)Tj
3.9515 0 Td
(to)Tj
1.0261 0 Td
(unify)Tj
2.3074 0 Td
(existing)Tj
3.3165 0 Td
(attempts)Tj
3.668 0 Td
(to)Tj
1.0262 0 Td
(represent)Tj
3.9571 0 Td
(DBF)Tj
-34.7128 -1.2982 Td
(knowledge)Tj
4.541 0 Td
(in)Tj
1.0375 0 Td
(a)Tj
0.652 0 Td
(reusable)Tj
3.5149 0 Td
(form)Tj
2.2053 0 Td
(and)Tj
1.7292 0 Td
(provide)Tj
3.2881 0 Td
(a)Tj
0.6577 0 Td
(unified)Tj
3.067 0 Td
(viewpoint)Tj
4.1896 0 Td
(of)Tj
1.0148 0 Td
(access.)Tj
2.8687 0 Td
(Metamodelling)Tj
6.3212 0 Td
(has)Tj
-35.087 -1.2983 Td
(been)Tj
2.1203 0 Td
(achieved)Tj
3.702 0 Td
(by)Tj
1.1848 0 Td
(way)Tj
1.7915 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4684 0 Td
(Object)Tj
2.8743 0 Td
(Management)Tj
5.5105 0 Td
(Group)Tj
2.8573 0 Td
(\(OMG\))Tj
3.2542 0 Td
([)Tj
0.83 0.64 0.02 0 k
(4)Tj
0 g
(].)Tj
1.6044 0 Td
(We)Tj
1.6044 0 Td
(explain)Tj
3.1237 0 Td
(our)Tj
1.6271 0 Td
(unifica-)Tj
-33.7377 -1.3039 Td
(tion)Tj
1.8425 0 Td
(method)Tj
3.3221 0 Td
(by)Tj
1.1792 0 Td
(offering)Tj
3.3789 0 Td
(common)Tj
3.8438 0 Td
(concepts)Tj
3.7247 0 Td
(and)Tj
1.7291 0 Td
(reconciled)Tj
4.3823 0 Td
(definitions)Tj
4.5241 0 Td
(that)Tj
1.7801 0 Td
(generalize)Tj
4.235 0 Td
(most)Tj
2.2053 0 Td
(of)Tj
-36.1471 -1.2983 Td
(the)Tj
1.4683 0 Td
(concepts)Tj
3.7247 0 Td
(used)Tj
2.0579 0 Td
(in)Tj
1.0375 0 Td
(existing)Tj
3.3165 0 Td
(DBF)Tj
2.0636 0 Td
(practices)Tj
3.7361 0 Td
(as)Tj
1.0148 0 Td
(described)Tj
4.0535 0 Td
(in)Tj
1.0375 0 Td
(existing)Tj
3.3165 0 Td
(models.)Tj
3.3278 0 Td
(This)Tj
1.9899 0 Td
(paper)Tj
2.4832 0 Td
(is)Tj
-34.6278 -1.2983 Td
(structured)Tj
4.3483 0 Td
(as)Tj
1.0148 0 Td
(follows:)Tj
3.2881 0 Td
(In)Tj
1.1055 0 Td
(Section)Tj
3.1635 0 Td
(2,)Tj
0.9241 0 Td
(we)Tj
1.3266 0 Td
(present)Tj
3.1634 0 Td
(some)Tj
2.3301 0 Td
(works)Tj
2.6419 0 Td
(related)Tj
2.9423 0 Td
(to)Tj
1.0261 0 Td
(this)Tj
1.6725 0 Td
(research.)Tj
3.7814 0 Td
(Section)Tj
3.1634 0 Td
(3)Tj
-35.892 -1.3039 Td
(provides)Tj
3.651 0 Td
(the)Tj
1.4683 0 Td
(actual)Tj
2.5795 0 Td
(development)Tj
5.4141 0 Td
(process)Tj
3.1805 0 Td
(of)Tj
1.0148 0 Td
(our)Tj
1.6271 0 Td
(DBF)Tj
2.0636 0 Td
(metamodel)Tj
4.7225 0 Td
(based)Tj
2.4718 0 Td
(on)Tj
1.2755 0 Td
(a)Tj
0.652 0 Td
(metamodelling)Tj
-30.1207 -1.2982 Td
(approach.)Tj
4.1782 0 Td
(Section)Tj
3.1634 0 Td
(4)Tj
0.6917 0 Td
(presents)Tj
3.5263 0 Td
(the)Tj
1.4683 0 Td
(validation)Tj
4.2066 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(proposed)Tj
3.9515 0 Td
(DBF)Tj
2.0636 0 Td
(Metamodel.)Tj
5.0173 0 Td
(Section)Tj
3.1634 0 Td
(5)Tj
0.6974 0 Td
(pres-)Tj
-34.6108 -1.2983 Td
(ents)Tj
1.8481 0 Td
(the)Tj
1.474 0 Td
(limitations)Tj
4.5298 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.474 0 Td
(DBF)Tj
2.0636 0 Td
(Metamodel.)Tj
5.0173 0 Td
(Finally,)Tj
3.1691 0 Td
(we)Tj
1.3266 0 Td
(conclude)Tj
3.8494 0 Td
(this)Tj
1.6724 0 Td
(paper)Tj
2.4832 0 Td
(in)Tj
1.0375 0 Td
(Section)Tj
3.1634 0 Td
(6)Tj
0.6973 0 Td
(with)Tj
-34.8205 -1.3039 Td
(recommendations)Tj
7.5004 0 Td
(for)Tj
1.3833 0 Td
(possible)Tj
3.4129 0 Td
(future)Tj
2.6532 0 Td
(work)Tj
2.279 0 Td
(related)Tj
2.948 0 Td
(to)Tj
1.0262 0 Td
(this)Tj
1.6724 0 Td
(paper.)Tj
ET
Q
q
1 j
1 J
0 w
11.9999 0 0 11.9999 200.0125 489.9968 cm
BT
/F2 1 Tf
1 TL
-0.0033 Tc
0 0 Td
(2.0)Tj
1.5921 0 Td
(Backgrounds)Tj
6.5622 0 Td
(and)Tj
1.9938 0 Td
(related)Tj
3.463 0 Td
(work)Tj
ET
Q
q
1 j
1 J
0 w
10 0 0 10 200.0125 472.9889 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(Several)Tj
3.05 0 Td
(types)Tj
2.2734 0 Td
(of)Tj
1.0148 0 Td
(modelling)Tj
4.2689 0 Td
(languages)Tj
4.1272 0 Td
(have)Tj
2.058 0 Td
(been)Tj
2.126 0 Td
(offered)Tj
3.0443 0 Td
(for)Tj
1.389 0 Td
(various)Tj
3.1408 0 Td
(disciplines,)Tj
4.6544 0 Td
(including)Tj
4.0422 0 Td
(busi-)Tj
-35.189 -1.2982 Td
(ness)Tj
1.9105 0 Td
(process)Tj
3.1861 0 Td
(modelling)Tj
4.269 0 Td
([)Tj
0.83 0.64 0.02 0 k
(5)Tj
0 g
(];)Tj
1.6044 0 Td
(systems)Tj
3.2995 0 Td
(engineering;)Tj
5.1987 0 Td
(and)Tj
1.7291 0 Td
(software)Tj
3.5886 0 Td
(engineering)Tj
4.972 0 Td
([)Tj
0.83 0.64 0.02 0 k
(6)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(7)Tj
0 g
(].)Tj
2.3017 0 Td
(These)Tj
2.5625 0 Td
(lan-)Tj
-34.6221 -1.2983 Td
(guages)Tj
2.8969 0 Td
(are)Tj
1.4457 0 Td
(naturally)Tj
3.7814 0 Td
(used)Tj
2.0636 0 Td
(to)Tj
1.0205 0 Td
(identify)Tj
3.2995 0 Td
(systems)Tj
3.2995 0 Td
(that)Tj
1.7745 0 Td
(can)Tj
1.627 0 Td
(provide)Tj
3.2882 0 Td
(a)Tj
0.652 0 Td
(better)Tj
2.5455 0 Td
(understanding)Tj
6.0661 0 Td
(for)Tj
-33.7604 -1.3039 Td
(stockholders.)Tj
5.4935 0 Td
(This)Tj
1.9899 0 Td
(study)Tj
2.3867 0 Td
(targets)Tj
2.8743 0 Td
(the)Tj
1.4684 0 Td
(emergence)Tj
4.541 0 Td
(of)Tj
1.0148 0 Td
(a)Tj
0.6577 0 Td
(modelling)Tj
4.2689 0 Td
(language)Tj
3.7644 0 Td
(to)Tj
1.0261 0 Td
(define)Tj
2.6986 0 Td
(the)Tj
1.4684 0 Td
(domain)Tj
-33.6527 -1.2983 Td
(of)Tj
1.0147 0 Td
(DBF.)Tj
2.2904 0 Td
(In)Tj
1.1055 0 Td
(addition,)Tj
3.8211 0 Td
(it)Tj
0.788 0 Td
(draws)Tj
2.5966 0 Td
(on)Tj
1.2755 0 Td
(research)Tj
3.5547 0 Td
(from)Tj
2.211 0 Td
(the)Tj
1.4683 0 Td
(field)Tj
1.9729 0 Td
(of)Tj
1.0148 0 Td
(metamodelling)Tj
6.2475 0 Td
([)Tj
0.83 0.64 0.02 0 k
(8)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(9)Tj
0 g
(])Tj
2.075 0 Td
(to)Tj
1.0261 0 Td
(develop)Tj
3.3165 0 Td
(a)Tj
-35.7786 -1.2982 Td
(process)Tj
3.1804 0 Td
(by)Tj
1.1849 0 Td
(which)Tj
2.6475 0 Td
(to)Tj
1.0262 0 Td
(create)Tj
2.5965 0 Td
(such)Tj
2.0579 0 Td
(a)Tj
0.652 0 Td
(language.)Tj
3.9911 0 Td
(Generally,)Tj
4.3087 0 Td
(a)Tj
0.6576 0 Td
(metamodelling)Tj
6.2419 0 Td
(process)Tj
3.1861 0 Td
(aims)Tj
2.1033 0 Td
(to)Tj
1.0261 0 Td
(gener-)Tj
-34.8602 -1.3039 Td
(ate)Tj
1.3719 0 Td
(a)Tj
0.6576 0 Td
(group)Tj
2.6079 0 Td
(of)Tj
/F10 1 Tf
1.0148 0 Td
[()13()4()10()-3()8()]TJ
/F5 1 Tf
2.6929 0 Td
(to)Tj
1.0261 0 Td
(represent)Tj
3.9572 0 Td
(domain)Tj
3.3278 0 Td
(entities)Tj
3.1068 0 Td
(and)Tj
1.7291 0 Td
(define)Tj
2.6986 0 Td
(domain)Tj
3.3221 0 Td
(concepts,)Tj
3.9515 0 Td
(actions)Tj
3.0557 0 Td
(or)Tj
-34.52 -1.2983 Td
(states)Tj
2.3924 0 Td
([)Tj
0.83 0.64 0.02 0 k
(10)Tj
0 g
(].)Tj
2.0806 0 Td
(This)Tj
1.9842 0 Td
(concept)Tj
3.3619 0 Td
(group)Tj
2.6079 0 Td
(is)Tj
0.8503 0 Td
(called)Tj
2.5229 0 Td
(the)Tj
/F10 1 Tf
1.4683 0 Td
[()6()8()11()16()6()4( )4()15()]TJ
/F5 1 Tf
(.)Tj
4.7678 0 Td
(The)Tj
1.7802 0 Td
(language)Tj
3.7644 0 Td
(that)Tj
1.7801 0 Td
(we)Tj
1.3266 0 Td
(look)Tj
1.9786 0 Td
(for)Tj
1.3833 0 Td
(is)Tj
0.8504 0 Td
(sup-)Tj
-34.8999 -1.2983 Td
(ported)Tj
2.8629 0 Td
(by)Tj
1.1849 0 Td
(the)Tj
/F10 1 Tf
1.4683 0 Td
[()6()8()11()16()6()4( )4()15()]TJ
/F5 1 Tf
(.)Tj
4.7679 0 Td
(It)Tj
0.856 0 Td
(has)Tj
1.5421 0 Td
(the)Tj
1.474 0 Td
(ability)Tj
2.6929 0 Td
(to)Tj
1.0261 0 Td
(generalize)Tj
4.2349 0 Td
(the)Tj
1.4684 0 Td
(domain)Tj
3.3222 0 Td
(by)Tj
1.1848 0 Td
(gathering)Tj
4.0195 0 Td
(all)Tj
1.1452 0 Td
(field/)Tj
-33.2501 -1.3039 Td
(domain)Tj
3.3221 0 Td
(concepts)Tj
3.7247 0 Td
(and)Tj
1.7292 0 Td
(dividing)Tj
3.5432 0 Td
(the)Tj
1.474 0 Td
(field/domain)Tj
5.4028 0 Td
(issues)Tj
2.5229 0 Td
(into)Tj
1.8425 0 Td
(sub-domain)Tj
5.0683 0 Td
(issues.)Tj
2.7439 0 Td
(A)Tj
0.9071 0 Td
(more)Tj
2.3414 0 Td
(diffi-)Tj
-34.6221 -1.2983 Td
(cult)Tj
1.7121 0 Td
(mission)Tj
3.3562 0 Td
(in)Tj
1.0318 0 Td
(the)Tj
1.4683 0 Td
(development)Tj
5.4141 0 Td
(of)Tj
1.0148 0 Td
(a)Tj
0.652 0 Td
(domain)Tj
3.3222 0 Td
(description)Tj
4.7338 0 Td
(is)Tj
0.8504 0 Td
(to)Tj
1.0261 0 Td
(determine)Tj
4.32 0 Td
(how)Tj
1.9389 0 Td
(the)Tj
1.4683 0 Td
(end)Tj
1.7235 0 Td
(user)Tj
1.9049 0 Td
(will)Tj
-35.9374 -1.2982 Td
(form)Tj
2.2053 0 Td
(his/her)Tj
3.0274 0 Td
(own)Tj
1.9615 0 Td
(model)Tj
2.744 0 Td
(with)Tj
1.9955 0 Td
(the)Tj
1.4684 0 Td
(concepts)Tj
3.7247 0 Td
(and)Tj
1.7291 0 Td
(notation)Tj
3.6283 0 Td
(from)Tj
2.2054 0 Td
(a)Tj
0.6576 0 Td
(domain)Tj
/F10 1 Tf
3.3222 0 Td
[()4()16(\n)13()-8()4()15()2()]TJ
/F5 1 Tf
(.)Tj
3.9288 0 Td
(In)Tj
1.1055 0 Td
(the)Tj
1.4683 0 Td
(field)Tj
-35.172 -1.2983 Td
(of)Tj
1.0147 0 Td
(software)Tj
3.5887 0 Td
(engineering,)Tj
5.193 0 Td
(a)Tj
0.6577 0 Td
(metamodel)Tj
4.7168 0 Td
(targets)Tj
2.8743 0 Td
(the)Tj
1.4683 0 Td
(generation)Tj
4.5071 0 Td
(of)Tj
1.0148 0 Td
(portable)Tj
3.5263 0 Td
(software)Tj
3.5829 0 Td
(actions)Tj
3.0614 0 Td
(and)Tj
-35.206 -1.3039 Td
(components.)Tj
5.3971 0 Td
(Further,)Tj
3.4922 0 Td
(it)Tj
0.7881 0 Td
(is)Tj
0.8504 0 Td
(interoperable)Tj
5.5558 0 Td
(and)Tj
1.7292 0 Td
(reusable.)Tj
3.7417 0 Td
(A)Tj
0.9014 0 Td
(metamodel)Tj
4.7225 0 Td
(also)Tj
1.7688 0 Td
(contains)Tj
3.6056 0 Td
(the)Tj
1.4684 0 Td
(descrip-)Tj
-34.0212 -1.2983 Td
(tion)Tj
1.8425 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(particular)Tj
4.1102 0 Td
(modelling)Tj
4.269 0 Td
(environment)Tj
5.4311 0 Td
(for)Tj
1.389 0 Td
(a)Tj
0.6519 0 Td
(firm)Tj
1.9673 0 Td
(domain)Tj
3.3221 0 Td
(and)Tj
1.7292 0 Td
(describes)Tj
3.8891 0 Td
(the)Tj
1.4683 0 Td
(syntax)Tj
2.7836 0 Td
(and)Tj
-35.3364 -1.2982 Td
(semantics)Tj
4.1555 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(domain.)Tj
3.549 0 Td
(It)Tj
0.8617 0 Td
(can)Tj
1.6214 0 Td
(be)Tj
1.1509 0 Td
(viewed)Tj
3.0047 0 Td
(from)Tj
2.2053 0 Td
(the)Tj
1.4684 0 Td
(following)Tj
3.9798 0 Td
(three)Tj
2.262 0 Td
(different)Tj
3.6567 0 Td
(perspectives:)Tj
5.2894 0 Td
(i\))Tj
0.8277 0 Td
(as)Tj
-36.5156 -1.3039 Td
(a)Tj
0.6519 0 Td
(set)Tj
1.3039 0 Td
(of)Tj
1.0148 0 Td
(structuring)Tj
4.6772 0 Td
(blocks)Tj
2.7609 0 Td
(and)Tj
1.7348 0 Td
(rules)Tj
2.1486 0 Td
(used)Tj
2.058 0 Td
(to)Tj
1.0261 0 Td
(construct)Tj
3.9798 0 Td
(and)Tj
1.7292 0 Td
(control)Tj
3.1237 0 Td
(new)Tj
1.8765 0 Td
(models;)Tj
3.3279 0 Td
(ii\))Tj
1.0942 0 Td
(as)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(model)Tj
-34.9906 -1.2983 Td
(of)Tj
1.0147 0 Td
(a)Tj
0.652 0 Td
(domain)Tj
3.3222 0 Td
(of)Tj
1.0148 0 Td
(interest;)Tj
3.4412 0 Td
(and)Tj
1.7292 0 Td
(iii\))Tj
1.3606 0 Td
(as)Tj
1.0148 0 Td
(an)Tj
1.2019 0 Td
(instance)Tj
3.5262 0 Td
(of)Tj
1.0148 0 Td
(another)Tj
3.3279 0 Td
(model.)Tj
2.9707 0 Td
(In)Tj
1.1111 0 Td
(our)Tj
1.6215 0 Td
(situation,)Tj
3.9571 0 Td
(a)Tj
0.652 0 Td
(metamodel)Tj
-32.9327 -1.2983 Td
(is)Tj
0.8447 0 Td
(an)Tj
1.2019 0 Td
(essential)Tj
3.5829 0 Td
(structuring)Tj
4.6828 0 Td
(block)Tj
2.3981 0 Td
(that)Tj
1.7802 0 Td
(creates)Tj
2.9536 0 Td
(statements)Tj
4.4901 0 Td
(about)Tj
2.4945 0 Td
(the)Tj
1.4683 0 Td
(possible)Tj
3.4072 0 Td
(structure)Tj
3.8268 0 Td
(of)Tj
1.0148 0 Td
(DBF)Tj
-34.1459 -1.3039 Td
(models)Tj
3.101 0 Td
([)Tj
0.83 0.64 0.02 0 k
(11)Tj
0 g
(].)Tj
-1.9048 -1.2983 Td
(Several)Tj
3.05 0 Td
(metamodelling)Tj
6.2475 0 Td
(frameworks)Tj
4.9776 0 Td
(have)Tj
2.058 0 Td
(been)Tj
2.126 0 Td
(defined)Tj
3.2258 0 Td
(by)Tj
1.1792 0 Td
(many)Tj
2.4774 0 Td
(information)Tj
5.074 0 Td
(systems)Tj
-31.6117 -1.2982 Td
(researchers,)Tj
4.9379 0 Td
(e.g.,)Tj
1.7801 0 Td
([)Tj
0.83 0.64 0.02 0 k
(17)Tj
0 g
()Tj
0.83 0.64 0.02 0 k
(24)Tj
0 g
(].)Tj
3.549 0 Td
(In)Tj
1.1055 0 Td
(this)Tj
1.6781 0 Td
(study,)Tj
2.6135 0 Td
(we)Tj
1.3266 0 Td
(follow)Tj
2.6986 0 Td
(a)Tj
0.6519 0 Td
(metamodelling)Tj
6.2476 0 Td
(framework)Tj
4.6147 0 Td
(based)Tj
2.4775 0 Td
(on)Tj
1.2756 0 Td
(the)Tj
-34.9566 -1.3039 Td
(Meta)Tj
2.2677 0 Td
(Object)Tj
2.8743 0 Td
(Facility)Tj
3.1407 0 Td
(\(MOF\))Tj
3.0671 0 Td
([)Tj
0.83 0.64 0.02 0 k
(12)Tj
0 g
(])Tj
1.8482 0 Td
(presented)Tj
4.1159 0 Td
(by)Tj
1.1848 0 Td
(OMG.)Tj
2.8006 0 Td
(Our)Tj
1.8652 0 Td
(DBF)Tj
2.0636 0 Td
(metamodel)Tj
4.7169 0 Td
(\(DBFM\))Tj
3.6396 0 Td
(will)Tj
1.6611 0 Td
(com-)Tj
-35.2457 -1.2983 Td
(prise)Tj
2.1599 0 Td
(a)Tj
0.652 0 Td
(set)Tj
1.3039 0 Td
(of)Tj
1.0148 0 Td
(concepts)Tj
3.7247 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4684 0 Td
(DBF)Tj
2.0636 0 Td
(Language)Tj
4.0535 0 Td
(and)Tj
1.7348 0 Td
(their)Tj
2.1033 0 Td
(relationships)Tj
5.3518 0 Td
(matching)Tj
4.0024 0 Td
(with)Tj
2.0013 0 Td
(the)Tj
1.4683 0 Td
(Meta-)Tj
-34.1175 -1.2983 Td
(model)Tj
2.7439 0 Td
(layer)Tj
2.1486 0 Td
(of)Tj
1.0148 0 Td
(MOF.)Tj
2.6135 0 Td
(Through)Tj
3.7588 0 Td
(the)Tj
1.4683 0 Td
(use)Tj
1.5307 0 Td
(of)Tj
1.0148 0 Td
(DBFM,)Tj
3.1804 0 Td
(it)Tj
0.7881 0 Td
(will)Tj
1.6611 0 Td
(be)Tj
1.1508 0 Td
(easier)Tj
2.5002 0 Td
(to)Tj
1.0261 0 Td
(manage)Tj
3.3449 0 Td
(multiple)Tj
-29.945 -1.2982 Td
(requirement)Tj
5.193 0 Td
(perspectives)Tj
5.057 0 Td
(as)Tj
1.0091 0 Td
(supported)Tj
4.2633 0 Td
(in)Tj
1.0261 0 Td
([)Tj
0.83 0.64 0.02 0 k
(13)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(14)Tj
0 g
(].)Tj
3.2485 0 Td
(DBFM)Tj
2.948 0 Td
(will)Tj
1.6611 0 Td
(identify)Tj
3.2882 0 Td
(the)Tj
1.4626 0 Td
(relationships)Tj
5.3405 0 Td
(existing)Tj
-34.4974 -1.304 Td
(between)Tj
3.5262 0 Td
(DBF)Tj
2.0636 0 Td
(models)Tj
3.1068 0 Td
(and)Tj
1.7291 0 Td
(indirectly)Tj
4.0479 0 Td
(define)Tj
2.6985 0 Td
(possible)Tj
3.4129 0 Td
(relationships)Tj
5.3461 0 Td
(between)Tj
3.532 0 Td
(the)Tj
1.4683 0 Td
(various)Tj
3.1408 0 Td
(perspec-)Tj
-34.0722 -1.2982 Td
(tives)Tj
2.0239 0 Td
(described)Tj
4.0535 0 Td
(by)Tj
1.1792 0 Td
(the)Tj
1.4683 0 Td
(models.)Tj
3.3336 0 Td
(This)Tj
1.9842 0 Td
(study)Tj
2.3924 0 Td
(will)Tj
1.6611 0 Td
(develop)Tj
3.3222 0 Td
(an)Tj
1.2019 0 Td
(iterative)Tj
3.4582 0 Td
(metamodelling)Tj
6.2475 0 Td
(process)Tj
3.1805 0 Td
(to)Tj
-35.5065 -1.2983 Td
(ensure)Tj
2.8743 0 Td
(that)Tj
1.7801 0 Td
(it)Tj
0.7824 0 Td
(becomes)Tj
3.685 0 Td
(domain-independen)Tj
8.2147 0 Td
(t.)Tj
0.7427 0 Td
(In)Tj
1.1055 0 Td
(other)Tj
2.3471 0 Td
(words,)Tj
2.897 0 Td
(the)Tj
1.474 0 Td
(resultant)Tj
3.7247 0 Td
(process)Tj
3.1861 0 Td
(will)Tj
1.6611 0 Td
(not)Tj
-34.4747 -1.3039 Td
(require)Tj
3.1124 0 Td
(an)Tj
1.2019 0 Td
(in-depth)Tj
3.6793 0 Td
(knowledge)Tj
4.5411 0 Td
(of)Tj
1.0148 0 Td
(DBF)Tj
2.0636 0 Td
(to)Tj
1.0261 0 Td
(enable)Tj
2.8006 0 Td
(the)Tj
1.474 0 Td
(production)Tj
4.7112 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.474 0 Td
(metamodel.)Tj
4.9436 0 Td
(We)Tj
1.61 0 Td
(will)Tj
-34.6674 -1.2983 Td
(apply)Tj
2.3867 0 Td
(it)Tj
0.788 0 Td
(to)Tj
1.0262 0 Td
(generate)Tj
3.6056 0 Td
(a)Tj
0.652 0 Td
(complete)Tj
3.8834 0 Td
(and)Tj
1.7291 0 Td
(comprehensive)Tj
6.2872 0 Td
(DBF)Tj
2.0637 0 Td
(metamodel,)Tj
4.9435 0 Td
(which)Tj
2.6533 0 Td
(will)Tj
1.6611 0 Td
(be)Tj
1.1508 0 Td
(the)Tj
1.4683 0 Td
(final)Tj
ET
Q
q
1 j
1 J
0 w
576 737.1 m
36 737.1 l
36 737.6 l
576 737.6 l
f*
36 741.2598 107.1496 23.6976 re
W* n
q
107.0929 0 0 23.6409 36 741.3165 cm
q
/I0 Do
Q
Q
Q
q
0 0 612 792 re
W* n
1 j
1 J
0 w
7.9999 0 0 7.9999 328.0251 745.7952 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(Developme)Tj
4.9677 0 Td
(nt)Tj
1.0417 0 Td
(and)Tj
1.8568 0 Td
(validation)Tj
4.3583 0 Td
(of)Tj
1.0417 0 Td
(a)Tj
0.7654 0 Td
(Databas)Tj
3.6567 0 Td
(e)Tj
0.7653 0 Td
(Forensic)Tj
3.9898 0 Td
(Metamodel)Tj
5.0883 0 Td
(\(DBFM\))Tj
ET
Q
q
1 j
1 J
0 w
36 48.0002 m
576 48.0002 l
576 47.5002 l
36 47.5002 l
f*
7.9999 0 0 7.9999 36 36 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(PLOS)Tj
2.8559 0 Td
(ONE)Tj
2.3669 0 Td
(|)Tj
0.4748 0 Td
(DOI:10.137)Tj
5.0387 0 Td
(1/journal.po)Tj
5.1236 0 Td
(ne.0170)Tj
3.5434 0 Td
(793)Tj
2.6362 0 Td
(February)Tj
4.1599 0 Td
(1,)Tj
1.0417 0 Td
(2017)Tj
37.8995 0 Td
(2)Tj
0.7654 0 Td
(/)Tj
ET
endstream
endobj
27 0 obj
<>stream
endstream
endobj
28 0 obj
<>stream
endstream
endobj
29 0 obj
<>stream
endstream
endobj
30 0 obj
<>stream
endstream
endobj
31 0 obj
<>stream
endstream
endobj
32 0 obj
<>stream
endstream
endobj
33 0 obj
<>stream
endstream
endobj
34 0 obj
<>stream
endstream
endobj
35 0 obj
<>stream
endstream
endobj
36 0 obj
<>stream
endstream
endobj
37 0 obj
<>stream
endstream
endobj
38 0 obj
<>stream
endstream
endobj
39 0 obj
<>stream
endstream
endobj
40 0 obj
<>stream
BT
66.402 0 Td
(34)Tj
ET
Q
endstream
endobj
41 0 obj
<>/XObject<>>>/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 10 0 R/Annots 42 0 R/Contents 43 0 R/TrimBox[0 0 612 792]>>
endobj
42 0 obj
[44 0 R 45 0 R 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R]
endobj
44 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref015)>>
endobj
45 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref016)>>
endobj
46 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref017)>>
endobj
47 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref018)>>
endobj
48 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref019)>>
endobj
49 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref020)>>
endobj
50 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref001)>>
endobj
51 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref021)>>
endobj
52 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref022)>>
endobj
53 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref023)>>
endobj
54 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref024)>>
endobj
55 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref025)>>
endobj
56 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref026)>>
endobj
57 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref027)>>
endobj
58 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref028)>>
endobj
59 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref023)>>
endobj
60 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref029)>>
endobj
61 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref030)>>
endobj
62 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref032)>>
endobj
43 0 obj
[63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R 76 0 R 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R]
endobj
63 0 obj
<>stream
q
0.83 0.64 0.02 0 k
516.9827 680.315 m
526.4504 680.315 l
h
f*
339.5339 641.3102 m
349.0583 641.3102 l
h
f*
351.326 641.3102 m
360.8504 641.3102 l
h
f*
268.9512 589.3228 m
278.4756 589.3228 l
h
f*
280.7433 589.3228 m
290.2677 589.3228 l
h
f*
322.1858 472.3087 m
331.7102 472.3087 l
h
f*
525.4866 420.3213 m
530.2488 420.3213 l
h
f*
364.8756 368.3339 m
374.4 368.3339 l
h
f*
499.748 368.3339 m
509.2724 368.3339 l
h
f*
224.7874 355.3512 m
234.3118 355.3512 l
h
f*
314.8157 355.3512 m
324.3402 355.3512 l
h
f*
446.1165 355.3512 m
455.5843 355.3512 l
h
f*
558.5386 355.3512 m
568.063 355.3512 l
h
f*
318.7843 342.3118 m
328.3087 342.3118 l
h
f*
474.8031 329.3291 m
484.3276 329.3291 l
h
f*
349.6252 290.3244 m
359.1496 290.3244 l
h
f*
539.1496 264.3024 m
548.674 264.3024 l
h
f*
482.3433 186.3496 m
491.811 186.3496 l
h
f*
497.0268 186.3496 m
506.4945 186.3496 l
h
f*
0 g
1 j
1 J
0 w
10 0 0 10 200.0125 707.4141 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(product)Tj
3.3902 0 Td
(of)Tj
1.0148 0 Td
(an)Tj
1.2018 0 Td
(iterative)Tj
3.4583 0 Td
(process.)Tj
3.4129 0 Td
(Its)Tj
1.2189 0 Td
(evolution)Tj
3.9968 0 Td
(will)Tj
1.6668 0 Td
(be)Tj
1.1508 0 Td
(interleaved)Tj
4.6375 0 Td
(with)Tj
1.9955 0 Td
(the)Tj
1.4741 0 Td
(validation)Tj
4.2009 0 Td
(process)Tj
3.1861 0 Td
(of)Tj
-36.0054 -1.3039 Td
(the)Tj
1.4683 0 Td
(metamodel.)Tj
4.9436 0 Td
(Any)Tj
1.9105 0 Td
(improvements)Tj
6.0321 0 Td
(resulting)Tj
3.7247 0 Td
(from)Tj
2.2053 0 Td
(the)Tj
1.4741 0 Td
(validation)Tj
4.2009 0 Td
(process)Tj
3.1861 0 Td
(\(e.g.,)Tj
2.126 0 Td
(concept)Tj
-31.2716 -1.2982 Td
(improvement/deletion/addition\))Tj
13.2887 0 Td
(will)Tj
1.6611 0 Td
(directly)Tj
3.2371 0 Td
(feed)Tj
1.8822 0 Td
(into)Tj
1.8369 0 Td
(the)Tj
1.474 0 Td
(iterative)Tj
3.4582 0 Td
(process.)Tj
3.4072 0 Td
(In)Tj
1.1112 0 Td
([)Tj
0.83 0.64 0.02 0 k
(15)Tj
0 g
(],)Tj
2.075 0 Td
(they)Tj
1.9218 0 Td
(iden-)Tj
-35.3534 -1.2983 Td
(tified)Tj
2.2903 0 Td
(a)Tj
0.652 0 Td
(number)Tj
3.4186 0 Td
(of)Tj
1.0148 0 Td
(techniques)Tj
4.5297 0 Td
(that)Tj
1.7801 0 Td
(use)Tj
1.5307 0 Td
(external)Tj
3.4299 0 Td
(sources)Tj
3.1975 0 Td
(to)Tj
1.0205 0 Td
(validate)Tj
3.3051 0 Td
(the)Tj
1.474 0 Td
(concepts)Tj
3.7191 0 Td
(in)Tj
1.0374 0 Td
(the)Tj
1.4684 0 Td
(metamo-)Tj
-33.8681 -1.2983 Td
(del)Tj
1.4173 0 Td
(\(e.g.,)Tj
2.1259 0 Td
(other)Tj
2.3471 0 Td
(existing)Tj
3.3165 0 Td
(models)Tj
3.1011 0 Td
(or)Tj
1.0998 0 Td
(DBF)Tj
2.0636 0 Td
(descriptions\).)Tj
5.658 0 Td
(Specifically,)Tj
4.9152 0 Td
(we)Tj
1.3266 0 Td
(illustrated)Tj
4.2236 0 Td
(the)Tj
-31.5947 -1.3039 Td
(`)Tj
/F10 1 Tf
[(\r)-2()11()15()4()16()-9()-4()-3()11(\n)]TJ
5.2213 0 Td
[()15()2()16()12(\n)9()]TJ
3.0274 0 Td
[()12()10()6()2()]TJ
2.245 0 Td
[()6()4( )4()15()-4()47()]TJ
/F5 1 Tf
3.1181 0 Td
([)Tj
0.83 0.64 0.02 0 k
(16)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(17)Tj
0 g
(])Tj
3.0331 0 Td
(using)Tj
2.3867 0 Td
(one)Tj
1.7008 0 Td
(external)Tj
3.4299 0 Td
(source)Tj
2.8346 0 Td
(to)Tj
1.0262 0 Td
(validate)Tj
3.3052 0 Td
(a)Tj
0.6519 0 Td
(part)Tj
1.8425 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
-34.8375 -1.2982 Td
(preliminary)Tj
4.9322 0 Td
(version)Tj
3.1408 0 Td
(of)Tj
1.0091 0 Td
(the)Tj
1.4627 0 Td
(metamodel.)Tj
4.9322 0 Td
(For)Tj
1.6158 0 Td
(the)Tj
1.4626 0 Td
(purpose)Tj
3.4356 0 Td
(of)Tj
1.0091 0 Td
(the)Tj
1.457 0 Td
(validation)Tj
4.2009 0 Td
(in)Tj
1.0262 0 Td
(this)Tj
1.6611 0 Td
(study,)Tj
2.6078 0 Td
(we)Tj
1.321 0 Td
(refine)Tj
-35.2741 -1.2983 Td
(18)Tj
1.1678 0 Td
(DBF)Tj
2.0636 0 Td
(models)Tj
3.1068 0 Td
(in)Tj
1.0375 0 Td
(detail)Tj
2.4151 0 Td
(by)Tj
1.1848 0 Td
(using)Tj
2.3868 0 Td
(our)Tj
1.6271 0 Td
(metamodel)Tj
4.7168 0 Td
(and)Tj
1.7348 0 Td
(applying)Tj
3.668 0 Td
(multiple)Tj
3.5659 0 Td
(validation)Tj
4.2066 0 Td
(techniques.)Tj
-31.6854 -1.3039 Td
(The)Tj
1.7858 0 Td
(quality)Tj
2.9537 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(metamodel)Tj
4.7225 0 Td
(is)Tj
0.8447 0 Td
(measured)Tj
4.1102 0 Td
(based)Tj
2.4718 0 Td
(on)Tj
1.2756 0 Td
(how)Tj
1.9389 0 Td
(well)Tj
1.8198 0 Td
(it)Tj
0.788 0 Td
(can)Tj
1.6271 0 Td
(achieve)Tj
3.1691 0 Td
(the)Tj
1.474 0 Td
(purpose)Tj
3.4413 0 Td
(of)Tj
-36.1018 -1.2983 Td
(its)Tj
1.1451 0 Td
(development)Tj
5.4085 0 Td
([)Tj
0.83 0.64 0.02 0 k
(18)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(19)Tj
0 g
(],)Tj
3.2542 0 Td
(specifically)Tj
4.5751 0 Td
(by)Tj
1.1792 0 Td
(addressing)Tj
4.507 0 Td
(the)Tj
1.4684 0 Td
(needs)Tj
2.5058 0 Td
(of)Tj
1.0148 0 Td
(domain)Tj
3.3221 0 Td
(practitioners;)Tj
5.5332 0 Td
(increas-)Tj
-33.9134 -1.2983 Td
(ing)Tj
1.5023 0 Td
(the)Tj
1.4683 0 Td
(transparency)Tj
5.4028 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.474 0 Td
(knowledge)Tj
4.5411 0 Td
(encoded)Tj
3.6 0 Td
(within)Tj
2.8119 0 Td
(the)Tj
1.4684 0 Td
(domain)Tj
3.3278 0 Td
(applications;)Tj
5.2668 0 Td
(and)Tj
1.7291 0 Td
(being)Tj
-33.6073 -1.3039 Td
(amenable)Tj
4.0535 0 Td
(to)Tj
1.0261 0 Td
(validation)Tj
4.2066 0 Td
(by)Tj
1.1792 0 Td
(experts)Tj
3.0841 0 Td
(in)Tj
1.0318 0 Td
(the)Tj
1.4683 0 Td
(domain)Tj
3.3279 0 Td
(area.)Tj
2.1089 0 Td
(Our)Tj
/F10 1 Tf
1.8652 0 Td
[()2(\n)6( )]TJ
1.6328 0 Td
[()-4()-3()2()5()]TJ
2.1599 0 Td
[( )4()11()6()16()12(\n)]TJ
3.5717 0 Td
[()11()20()6()-4()7()14()7()4()11(\n)6()2()5()]TJ
/F5 1 Tf
-30.716 -1.2982 Td
(include)Tj
3.1804 0 Td
(a)Tj
0.6576 0 Td
(database)Tj
3.6397 0 Td
(administrator,)Tj
5.947 0 Td
(a)Tj
0.6577 0 Td
(DBF)Tj
2.0636 0 Td
(investigator)Tj
4.9152 0 Td
(and/or)Tj
2.9367 0 Td
(response)Tj
3.736 0 Td
(managers)Tj
4.0762 0 Td
(for)Tj
1.3833 0 Td
(various)Tj
-33.1934 -1.2983 Td
(public)Tj
2.7099 0 Td
(and)Tj
1.7291 0 Td
(private)Tj
2.9877 0 Td
(database)Tj
3.634 0 Td
(organizations)Tj
5.6465 0 Td
(seeking)Tj
3.2032 0 Td
(to)Tj
1.0261 0 Td
(create)Tj
2.5909 0 Td
(a)Tj
0.6576 0 Td
(DBF)Tj
2.0636 0 Td
(model)Tj
2.7439 0 Td
(to)Tj
1.0262 0 Td
(manage)Tj
3.3448 0 Td
(expected)Tj
-33.3635 -1.3039 Td
(database)Tj
3.6396 0 Td
(incidents.)Tj
4.1102 0 Td
(Database)Tj
3.8494 0 Td
(Forensics)Tj
4.0082 0 Td
(\(DBF\))Tj
2.7439 0 Td
(includes)Tj
3.5433 0 Td
(all)Tj
1.1509 0 Td
(features)Tj
3.3448 0 Td
(of)Tj
1.0148 0 Td
(preparation)Tj
4.9096 0 Td
(and)Tj
1.7291 0 Td
(response)Tj
-34.0438 -1.2983 Td
(to)Tj
1.0147 0 Td
(all)Tj
1.1396 0 Td
(processes)Tj
3.9571 0 Td
(of)Tj
1.0035 0 Td
(database)Tj
3.634 0 Td
(forensic)Tj
3.3958 0 Td
(investigation,)Tj
5.5786 0 Td
(including)Tj
/F10 1 Tf
4.0308 0 Td
[()4( )4()2(\n)22()7()12()-8()4()7()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.6353 0 Td
[()7()10()4()4()7()-4()7()4()11(\n)]TJ
3.8437 0 Td
[()16(\n)6( )]TJ
1.7178 0 Td
[()11()20()8()-3()2()19()]TJ
-34.9509 -1.2982 Td
[()3()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.9196 0 Td
[()16(\n)6()11()15()2()10()-4()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.5433 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[()11()20()8()-3()2(\n)22()11()22()7()4()11(\n)]TJ
/F5 1 Tf
5.0457 0 Td
(activities.)Tj
-12.0415 -1.2983 Td
(This)Tj
1.9899 0 Td
(study)Tj
2.3867 0 Td
(targets)Tj
2.8743 0 Td
(a)Tj
0.652 0 Td
(reduction)Tj
4.1159 0 Td
(of)Tj
1.0148 0 Td
(interoperability)Tj
6.4232 0 Td
(challenges)Tj
4.32 0 Td
(and)Tj
1.7291 0 Td
(facilitates)Tj
3.9629 0 Td
(the)Tj
1.4683 0 Td
(process)Tj
3.1861 0 Td
(of)Tj
-35.3194 -1.3039 Td
(knowledge-sharing)Tj
7.8689 0 Td
(similar)Tj
2.982 0 Td
(to)Tj
1.0261 0 Td
([)Tj
0.83 0.64 0.02 0 k
(20)Tj
0 g
(],)Tj
2.075 0 Td
(but)Tj
1.5534 0 Td
(in)Tj
1.0374 0 Td
(DBF.)Tj
2.2904 0 Td
(It)Tj
0.8561 0 Td
(is)Tj
0.8504 0 Td
(common)Tj
3.8437 0 Td
(that)Tj
1.7802 0 Td
(no)Tj
1.2755 0 Td
(two)Tj
1.7065 0 Td
(database)Tj
3.6397 0 Td
(incidents)Tj
-32.7853 -1.2983 Td
(are)Tj
1.4456 0 Td
(precisely)Tj
3.7077 0 Td
(the)Tj
1.474 0 Td
(same)Tj
2.2564 0 Td
(and)Tj
1.7291 0 Td
(that)Tj
1.7801 0 Td
(every)Tj
2.3471 0 Td
(database)Tj
3.6397 0 Td
(incident)Tj
3.5263 0 Td
(needs)Tj
2.5001 0 Td
(its)Tj
1.1509 0 Td
(own)Tj
1.9558 0 Td
(managing)Tj
4.201 0 Td
(process.)Tj
3.4129 0 Td
(How-)Tj
-35.1267 -1.2983 Td
(ever,)Tj
2.1146 0 Td
(the)Tj
1.474 0 Td
(ways)Tj
2.1543 0 Td
(in)Tj
1.0318 0 Td
(which)Tj
2.6532 0 Td
(database)Tj
3.6397 0 Td
(incidents)Tj
3.8834 0 Td
(affect)Tj
2.3754 0 Td
(database)Tj
3.6397 0 Td
(integrity)Tj
3.6113 0 Td
(and)Tj
1.7348 0 Td
(business)Tj
3.5716 0 Td
(continuity)Tj
4.3654 0 Td
(are)Tj
-36.2492 -1.3039 Td
(similar,)Tj
3.2087 0 Td
(and)Tj
1.7292 0 Td
(responses)Tj
4.0988 0 Td
(are)Tj
1.4457 0 Td
(often)Tj
2.2847 0 Td
(transferrable)Tj
5.3008 0 Td
(between)Tj
3.5262 0 Td
(database)Tj
3.6397 0 Td
(incidents.)Tj
4.1102 0 Td
(For)Tj
1.6271 0 Td
(example,)Tj
3.7757 0 Td
(a)Tj
/F10 1 Tf
0.652 0 Td
[()7()10()]TJ
-35.3988 -1.2982 Td
[()4()7()-4()7()4()11(\n)]TJ
2.7779 0 Td
[()11()]TJ
0.9524 0 Td
[()3()10()4()22()7()4()4()]TJ
3.0331 0 Td
[( )4()22()11()]TJ
/F5 1 Tf
1.9842 0 Td
(is)Tj
0.8504 0 Td
(a)Tj
0.652 0 Td
(DBF)Tj
2.0636 0 Td
(action)Tj
2.6985 0 Td
(that)Tj
1.7802 0 Td
(is)Tj
0.8504 0 Td
(applicable)Tj
4.2349 0 Td
(in)Tj
1.0375 0 Td
(various)Tj
3.1407 0 Td
(DBF)Tj
2.0637 0 Td
(situations)Tj
4.0875 0 Td
([)Tj
0.83 0.64 0.02 0 k
(1)Tj
0 g
(].)Tj
1.6044 0 Td
(We)Tj
1.6101 0 Td
(use)Tj
1.5307 0 Td
(a)Tj
-36.9522 -1.2983 Td
(variety)Tj
2.9196 0 Td
(of)Tj
1.0205 0 Td
(models)Tj
3.1011 0 Td
(and)Tj
1.7291 0 Td
(frameworks)Tj
4.9776 0 Td
(that)Tj
1.7801 0 Td
(have)Tj
2.058 0 Td
(been)Tj
2.126 0 Td
(developed)Tj
4.2689 0 Td
(by)Tj
1.1792 0 Td
(many)Tj
2.4775 0 Td
(domain)Tj
3.3278 0 Td
(experts,)Tj
3.3052 0 Td
(investi-)Tj
-34.2706 -1.3039 Td
(gators,)Tj
2.8799 0 Td
(or)Tj
1.0999 0 Td
(companies)Tj
4.5184 0 Td
(on)Tj
1.2755 0 Td
(the)Tj
1.4741 0 Td
(subject)Tj
3.016 0 Td
(of)Tj
1.0148 0 Td
(DBF)Tj
2.0636 0 Td
(studies.)Tj
3.2088 0 Td
(Existing)Tj
3.4639 0 Td
(DBF)Tj
2.0636 0 Td
(models)Tj
3.1068 0 Td
(can)Tj
1.6271 0 Td
(be)Tj
1.1508 0 Td
(categorized)Tj
4.7735 0 Td
(as)Tj
/F10 1 Tf
-36.7367 -1.2983 Td
[()20()7()14()12()12()20()2()6()2(\n)22()]TJ
5.3234 0 Td
[()6()4( )4()15()-4()]TJ
/F5 1 Tf
2.914 0 Td
(because)Tj
3.3222 0 Td
(of)Tj
1.0148 0 Td
(abstract)Tj
3.3448 0 Td
(representations)Tj
6.3779 0 Td
(of)Tj
1.0148 0 Td
(an)Tj
1.2019 0 Td
(existing)Tj
3.3165 0 Td
(or)Tj
1.0942 0 Td
(a)Tj
0.6576 0 Td
(desired)Tj
3.1181 0 Td
(model)Tj
2.7439 0 Td
(in)Tj
-35.4441 -1.2983 Td
(the)Tj
1.4683 0 Td
(real)Tj
1.6951 0 Td
(world)Tj
2.5568 0 Td
(\(e.g.,)Tj
2.126 0 Td
(detection)Tj
3.9345 0 Td
(tampering)Tj
4.3653 0 Td
([)Tj
0.83 0.64 0.02 0 k
(21)Tj
0 g
(],)Tj
2.0806 0 Td
(preparation)Tj
4.9096 0 Td
(and)Tj
1.7291 0 Td
(verification)Tj
4.7678 0 Td
([)Tj
0.83 0.64 0.02 0 k
(22)Tj
0 g
(],)Tj
2.075 0 Td
(technology)Tj
-31.7081 -1.2982 Td
(tools)Tj
2.1373 0 Td
([)Tj
0.83 0.64 0.02 0 k
(23)Tj
0 g
(],)Tj
2.0749 0 Td
(decision-making)Tj
6.9278 0 Td
([)Tj
0.83 0.64 0.02 0 k
(24)Tj
0 g
(],)Tj
2.0807 0 Td
(response)Tj
3.7303 0 Td
(and)Tj
1.7291 0 Td
(identification)Tj
5.5899 0 Td
([)Tj
0.83 0.64 0.02 0 k
(25)Tj
0 g
(],)Tj
2.075 0 Td
(collection)Tj
4.1102 0 Td
(and)Tj
1.7291 0 Td
(analysis)Tj
3.3279 0 Td
([)Tj
0.83 0.64 0.02 0 k
(26)Tj
0 g
(],)Tj
-35.5122 -1.3039 Td
(and)Tj
1.7291 0 Td
(reconstruction)Tj
6.0944 0 Td
(evidence)Tj
3.7134 0 Td
([)Tj
0.83 0.64 0.02 0 k
(27)Tj
0 g
(]\).)Tj
2.4151 0 Td
(The)Tj
1.7858 0 Td
(meaning)Tj
3.7247 0 Td
(and)Tj
1.7291 0 Td
(definition)Tj
4.1669 0 Td
(of)Tj
1.0148 0 Td
(specific)Tj
3.1918 0 Td
(concept)Tj
3.3619 0 Td
(terminolo-)Tj
-32.927 -1.2983 Td
(gies)Tj
1.7347 0 Td
(and)Tj
1.7292 0 Td
(their)Tj
2.1089 0 Td
(relationships)Tj
5.3518 0 Td
(may)Tj
1.9276 0 Td
(differ)Tj
2.3867 0 Td
(from)Tj
2.2053 0 Td
(one)Tj
1.7008 0 Td
(observer)Tj
3.634 0 Td
(to)Tj
1.0262 0 Td
(another)Tj
3.3335 0 Td
([)Tj
0.83 0.64 0.02 0 k
(28)Tj
0 g
(].)Tj
2.0749 0 Td
(Domain)Tj
3.532 0 Td
(concepts)Tj
-32.7456 -1.2983 Td
(can)Tj
1.627 0 Td
(have)Tj
2.058 0 Td
(multiple)Tj
3.5659 0 Td
(descriptions.)Tj
5.3178 0 Td
(Some)Tj
2.4491 0 Td
(concepts)Tj
3.719 0 Td
(are)Tj
1.4514 0 Td
(observed)Tj
3.7927 0 Td
(to)Tj
1.0261 0 Td
(represent)Tj
3.9572 0 Td
(similar)Tj
2.9877 0 Td
(DBF)Tj
2.0636 0 Td
(activities)Tj
-34.0155 -1.3039 Td
(that)Tj
1.7744 0 Td
(are)Tj
1.4514 0 Td
(expressed)Tj
4.0932 0 Td
(differently.)Tj
4.5807 0 Td
(For)Tj
1.6271 0 Td
(example,)Tj
3.7757 0 Td
(in)Tj
1.0375 0 Td
(a)Tj
0.652 0 Td
(System)Tj
3.0557 0 Td
(and)Tj
1.7291 0 Td
(Method)Tj
3.3959 0 Td
(for)Tj
1.389 0 Td
(Investigating)Tj
5.3914 0 Td
(a)Tj
0.652 0 Td
(Data)Tj
-34.6051 -1.2982 Td
(Operation)Tj
4.3313 0 Td
(Performed)Tj
4.5127 0 Td
(on)Tj
1.2756 0 Td
(a)Tj
0.6519 0 Td
(Database)Tj
3.8495 0 Td
([)Tj
0.83 0.64 0.02 0 k
(23)Tj
0 g
(],)Tj
2.0749 0 Td
(the)Tj
1.4683 0 Td
(terminology)Tj
5.1307 0 Td
(`)Tj
/F10 1 Tf
[()2()7()7()11(\n)9()7()-9()4()-4()7()12(\n)13()]TJ
6.1852 0 Td
[()-6()22()11()22()4()-3()57()]TJ
/F5 1 Tf
4.0762 0 Td
(is)Tj
0.8447 0 Td
(used)Tj
2.0636 0 Td
(to)Tj
-36.4646 -1.2983 Td
(reconstruct)Tj
4.7735 0 Td
(the)Tj
1.4683 0 Td
(database)Tj
3.6397 0 Td
(events)Tj
2.7325 0 Td
(from)Tj
2.2054 0 Td
(logs)Tj
1.7971 0 Td
(and)Tj
1.7292 0 Td
(memory)Tj
3.6169 0 Td
(caches.)Tj
3.0388 0 Td
(The)Tj
1.7801 0 Td
(same)Tj
2.262 0 Td
(activity,)Tj
3.3392 0 Td
(however,)Tj
3.8381 0 Td
(is)Tj
-36.2208 -1.3039 Td
(represented)Tj
4.9095 0 Td
(using)Tj
2.3868 0 Td
(`)Tj
/F10 1 Tf
[()2()20()11()12()4()4( )12()12(\n)13()20()]TJ
/F5 1 Tf
4.8472 0 Td
(in)Tj
1.0318 0 Td
(the)Tj
1.4683 0 Td
(Database)Tj
3.8495 0 Td
(Application)Tj
4.9322 0 Td
(Schema)Tj
3.3222 0 Td
(Forensics)Tj
4.0138 0 Td
(Model)Tj
2.812 0 Td
([)Tj
0.83 0.64 0.02 0 k
(29)Tj
0 g
(].)Tj
2.0806 0 Td
(A)Tj
-35.6539 -1.2983 Td
(specific)Tj
3.1804 0 Td
(domain)Tj
3.3165 0 Td
(modelling)Tj
4.269 0 Td
(language)Tj
3.753 0 Td
(expressed)Tj
4.0875 0 Td
(as)Tj
1.0092 0 Td
(a)Tj
0.6463 0 Td
(metamodel)Tj
4.7111 0 Td
(can)Tj
1.6214 0 Td
(offer)Tj
2.092 0 Td
(an)Tj
1.1905 0 Td
(alternative)Tj
4.4164 0 Td
(and)Tj
1.7234 0 Td
(bet-)Tj
-36.0167 -1.2983 Td
(ter)Tj
1.3095 0 Td
(approach)Tj
3.9572 0 Td
(towards)Tj
3.4015 0 Td
(resolving)Tj
3.8608 0 Td
(this)Tj
1.6781 0 Td
(type)Tj
1.9105 0 Td
(of)Tj
1.0148 0 Td
(problem.)Tj
3.8381 0 Td
(Our)Tj
1.8652 0 Td
(approach)Tj
3.9515 0 Td
(unifies)Tj
2.9026 0 Td
(the)Tj
1.474 0 Td
(various)Tj
3.1408 0 Td
(termi-)Tj
-34.3046 -1.3039 Td
(nologies)Tj
3.5432 0 Td
(used.)Tj
2.2847 0 Td
(The)Tj
1.7859 0 Td
(DBF)Tj
2.0636 0 Td
(Metamodel)Tj
4.7905 0 Td
(\(DBFM\))Tj
3.6397 0 Td
(developed)Tj
4.2689 0 Td
(in)Tj
1.0375 0 Td
(this)Tj
1.6724 0 Td
(study)Tj
2.3868 0 Td
(describes)Tj
3.8891 0 Td
(all)Tj
1.1452 0 Td
(the)Tj
1.4683 0 Td
(DBF)Tj
-33.9758 -1.2982 Td
(model)Tj
2.7439 0 Td
(concepts)Tj
3.719 0 Td
(and)Tj
1.7348 0 Td
(the)Tj
1.4683 0 Td
(way)Tj
1.7915 0 Td
(they)Tj
1.9276 0 Td
(are)Tj
1.4456 0 Td
(arranged/organized,)Tj
8.3112 0 Td
(linked)Tj
2.7269 0 Td
(and)Tj
1.7291 0 Td
(constrained.)Tj
5.159 0 Td
(It)Tj
0.8561 0 Td
(also)Tj
1.7688 0 Td
(pro-)Tj
-35.3818 -1.2983 Td
(vides)Tj
2.2506 0 Td
(a)Tj
0.6577 0 Td
(flexible)Tj
3.0841 0 Td
(structure)Tj
3.821 0 Td
(by)Tj
1.1849 0 Td
(which)Tj
2.6475 0 Td
(to)Tj
1.0262 0 Td
(facilitate)Tj
3.6 0 Td
(the)Tj
1.4683 0 Td
(storage)Tj
3.0841 0 Td
(and)Tj
1.7291 0 Td
(retrieval)Tj
3.5093 0 Td
(of)Tj
1.0148 0 Td
(DBF)Tj
2.0636 0 Td
(knowledge.)Tj
-31.1412 -1.2983 Td
(This)Tj
1.9842 0 Td
(work)Tj
2.279 0 Td
(is)Tj
0.8504 0 Td
(extended)Tj
3.8551 0 Td
(to)Tj
1.0261 0 Td
(our)Tj
1.6271 0 Td
(works)Tj
2.6419 0 Td
(published)Tj
4.1215 0 Td
(between)Tj
3.532 0 Td
(2014)Tj
2.1203 0 Td
(and)Tj
1.7291 0 Td
(2016)Tj
2.126 0 Td
([)Tj
0.83 0.64 0.02 0 k
(30)Tj
0 g
()Tj
0.83 0.64 0.02 0 k
(32)Tj
0 g
(].)Tj
-26.6965 -1.3039 Td
(Therefore,)Tj
4.3936 0 Td
(DBF)Tj
2.0636 0 Td
(domain)Tj
3.3279 0 Td
(has)Tj
1.542 0 Td
(been)Tj
2.1203 0 Td
(discussed)Tj
4.0025 0 Td
(from)Tj
2.2054 0 Td
(three)Tj
2.262 0 Td
(perspectives:)Tj
5.2894 0 Td
(i\))Tj
0.8277 0 Td
(Database)Tj
3.8438 0 Td
(Forensic)Tj
-33.0744 -1.2983 Td
(Dimensions)Tj
5.0569 0 Td
(-based)Tj
2.8233 0 Td
(\(e.g.,)Tj
2.126 0 Td
(destroyed,)Tj
4.3426 0 Td
(compromised,)Tj
5.9868 0 Td
(and)Tj
1.7291 0 Td
(changed\);)Tj
4.1385 0 Td
(ii\))Tj
1.0942 0 Td
(Database)Tj
3.8494 0 Td
(Forensic)Tj
3.6454 0 Td
(Tech-)Tj
-34.7922 -1.2982 Td
(nology-based)Tj
5.5502 0 Td
(\(e.g.,)Tj
2.1259 0 Td
(tools,)Tj
2.3641 0 Td
(algorithms,)Tj
4.7452 0 Td
(and)Tj
1.7291 0 Td
(methods\);)Tj
4.2519 0 Td
(and)Tj
1.7292 0 Td
(iii\))Tj
1.3606 0 Td
(Database)Tj
3.8494 0 Td
(Forensic)Tj
3.6453 0 Td
(Investigation)Tj
-31.3509 -1.3039 Td
(Process-based)Tj
5.8279 0 Td
(\(e.g.,)Tj
2.126 0 Td
(Identification,)Tj
5.8847 0 Td
(Artefact)Tj
3.4412 0 Td
(collection,)Tj
4.337 0 Td
(Artefact)Tj
3.4413 0 Td
(analysis,)Tj
3.5489 0 Td
(Documentation)Tj
6.5593 0 Td
(and)Tj
-35.1663 -1.2983 Td
(Presentation\).)Tj
5.8223 0 Td
(Compromised)Tj
6.0037 0 Td
(database)Tj
3.6397 0 Td
(define)Tj
2.6985 0 Td
(as)Tj
1.0148 0 Td
(a)Tj
0.6577 0 Td
(database)Tj
3.6396 0 Td
(where)Tj
2.6476 0 Td
(some)Tj
2.33 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.474 0 Td
(metadata)Tj
3.8892 0 Td
(or)Tj
-34.8319 -1.2983 Td
(some)Tj
2.33 0 Td
(software)Tj
3.5887 0 Td
(of)Tj
1.0147 0 Td
(the)Tj
1.4684 0 Td
(database)Tj
3.6396 0 Td
(management)Tj
5.4312 0 Td
(system)Tj
2.9423 0 Td
(\(DBMS\))Tj
3.583 0 Td
(have)Tj
2.0579 0 Td
(been)Tj
2.126 0 Td
(modified)Tj
3.8438 0 Td
(by)Tj
1.1848 0 Td
(an)Tj
1.2019 0 Td
(attacker)Tj
-34.4123 -1.3039 Td
(even)Tj
2.0692 0 Td
(though)Tj
3.0728 0 Td
(the)Tj
1.4683 0 Td
(database)Tj
3.6397 0 Td
(is)Tj
0.8504 0 Td
(still)Tj
1.6384 0 Td
(operational.)Tj
5.0003 0 Td
(Modified)Tj
3.9174 0 Td
(database:)Tj
3.8664 0 Td
(In)Tj
1.1112 0 Td
(contrast)Tj
3.4583 0 Td
(to)Tj
1.0261 0 Td
(compromised)Tj
-31.1185 -1.2982 Td
(databases,)Tj
4.2235 0 Td
(the)Tj
1.4684 0 Td
(category)Tj
3.6 0 Td
(of)Tj
1.0148 0 Td
(damaged)Tj
3.8494 0 Td
(or)Tj
1.0998 0 Td
(destroyed)Tj
4.1159 0 Td
(databases)Tj
3.9968 0 Td
(refers)Tj
2.4605 0 Td
(to)Tj
1.0261 0 Td
(databases)Tj
4.0025 0 Td
(where)Tj
2.6476 0 Td
(the)Tj
1.4683 0 Td
(data)Tj
ET
Q
q
1 j
1 J
0 w
576 737.1 m
36 737.1 l
36 737.6 l
576 737.6 l
f*
36 741.2598 107.1496 23.6976 re
W* n
q
107.0929 0 0 23.6409 36 741.3165 cm
q
/I0 Do
Q
Q
Q
q
0 0 612 792 re
W* n
1 j
1 J
0 w
7.9999 0 0 7.9999 328.0251 745.7952 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(Developme)Tj
4.9677 0 Td
(nt)Tj
1.0417 0 Td
(and)Tj
1.8568 0 Td
(validation)Tj
4.3583 0 Td
(of)Tj
1.0417 0 Td
(a)Tj
0.7654 0 Td
(Databas)Tj
3.6567 0 Td
(e)Tj
0.7653 0 Td
(Forensic)Tj
3.9898 0 Td
(Metamodel)Tj
5.0883 0 Td
(\(DBFM\))Tj
ET
Q
q
1 j
1 J
0 w
36 48.0002 m
576 48.0002 l
576 47.5002 l
36 47.5002 l
f*
7.9999 0 0 7.9999 36 36 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(PLOS)Tj
2.8559 0 Td
(ONE)Tj
2.3669 0 Td
(|)Tj
0.4748 0 Td
(DOI:10.137)Tj
5.0387 0 Td
(1/journal.po)Tj
5.1236 0 Td
(ne.0170)Tj
3.5434 0 Td
(793)Tj
2.6362 0 Td
(February)Tj
4.1599 0 Td
(1,)Tj
1.0417 0 Td
(2017)Tj
37.8995 0 Td
(3)Tj
0.7654 0 Td
(/)Tj
ET
endstream
endobj
64 0 obj
<>stream
endstream
endobj
65 0 obj
<>stream
endstream
endobj
66 0 obj
<>stream
endstream
endobj
67 0 obj
<>stream
endstream
endobj
68 0 obj
<>stream
endstream
endobj
69 0 obj
<>stream
endstream
endobj
70 0 obj
<>stream
endstream
endobj
71 0 obj
<>stream
endstream
endobj
72 0 obj
<>stream
endstream
endobj
73 0 obj
<>stream
endstream
endobj
74 0 obj
<>stream
endstream
endobj
75 0 obj
<>stream
endstream
endobj
76 0 obj
<>stream
endstream
endobj
77 0 obj
<>stream
endstream
endobj
78 0 obj
<>stream
endstream
endobj
79 0 obj
<>stream
endstream
endobj
80 0 obj
<>stream
endstream
endobj
81 0 obj
<>stream
BT
66.402 0 Td
(34)Tj
ET
Q
endstream
endobj
82 0 obj
<>/XObject<>>>/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 10 0 R/Annots 84 0 R/Contents 85 0 R/TrimBox[0 0 612 792]>>
endobj
84 0 obj
[86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R]
endobj
86 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref023)>>
endobj
87 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref033)>>
endobj
88 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref025)>>
endobj
89 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref034)>>
endobj
90 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref039)>>
endobj
91 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref001)>>
endobj
92 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref003)>>
endobj
93 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref022)>>
endobj
94 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref024)>>
endobj
95 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref026)>>
endobj
96 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref027)>>
endobj
97 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref029)>>
endobj
98 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref040)>>
endobj
99 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref066)>>
endobj
100 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref064)>>
endobj
101 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref023)>>
endobj
102 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref033)>>
endobj
103 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref025)>>
endobj
104 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref022)>>
endobj
105 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref044)>>
endobj
106 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref001)>>
endobj
107 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref067)>>
endobj
108 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref052)>>
endobj
85 0 obj
[109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R]
endobj
109 0 obj
<>stream
q
0.83 0.64 0.02 0 k
328.5921 576.3402 m
338.0598 576.3402 l
h
f*
469.2472 550.3181 m
478.7717 550.3181 l
h
f*
282.7276 524.2961 m
292.252 524.2961 l
h
f*
294.463 524.2961 m
303.9874 524.2961 l
h
f*
309.2031 524.2961 m
318.6709 524.2961 l
h
f*
416.8063 511.3134 m
421.5685 511.3134 l
h
f*
426.7276 511.3134 m
431.4898 511.3134 l
h
f*
433.7575 511.3134 m
443.2252 511.3134 l
h
f*
445.4929 511.3134 m
455.0173 511.3134 l
h
f*
457.285 511.3134 m
466.8094 511.3134 l
h
f*
469.0205 511.3134 m
478.5449 511.3134 l
h
f*
480.8126 511.3134 m
490.337 511.3134 l
h
f*
492.548 511.3134 m
502.0724 511.3134 l
h
f*
507.2315 511.3134 m
516.7559 511.3134 l
h
f*
505.7575 407.3386 m
515.2819 407.3386 l
h
f*
499.1244 329.3291 m
508.6488 329.3291 l
h
f*
257.9528 290.3244 m
267.4205 290.3244 l
h
f*
230.8535 251.3197 m
240.378 251.3197 l
h
f*
230.8535 225.2976 m
240.378 225.2976 l
h
f*
461.2535 160.3276 m
470.778 160.3276 l
h
f*
306.652 147.3449 m
311.4142 147.3449 l
h
f*
325.7575 121.3228 m
335.2252 121.3228 l
h
f*
380.0126 82.3181 m
389.537 82.3181 l
h
f*
0 g
1 j
1 J
0 w
10 0 0 10 200.0125 707.4141 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(contained)Tj
4.1952 0 Td
(or)Tj
1.0998 0 Td
(other)Tj
2.3471 0 Td
(data)Tj
1.9162 0 Td
(files)Tj
1.8028 0 Td
(may)Tj
1.9276 0 Td
(have)Tj
2.0636 0 Td
(been)Tj
2.1203 0 Td
(modified,)Tj
4.0762 0 Td
(deleted)Tj
3.0897 0 Td
(or)Tj
1.0942 0 Td
(copied)Tj
2.8913 0 Td
(from)Tj
2.2054 0 Td
(their)Tj
2.1033 0 Td
(original)Tj
-32.9327 -1.3039 Td
(locations)Tj
3.8097 0 Td
(into)Tj
1.8425 0 Td
(other)Tj
2.3471 0 Td
(places.)Tj
2.8516 0 Td
(These)Tj
2.5682 0 Td
(databases)Tj
3.9968 0 Td
(may)Tj
1.9276 0 Td
(or)Tj
1.0998 0 Td
(may)Tj
1.9275 0 Td
(no)Tj
1.2756 0 Td
(longer)Tj
2.7836 0 Td
(be)Tj
1.1509 0 Td
(operational)Tj
4.7735 0 Td
(depending)Tj
-32.3544 -1.2982 Td
(on)Tj
1.2699 0 Td
(the)Tj
1.4626 0 Td
(extent)Tj
2.6703 0 Td
(of)Tj
1.0091 0 Td
(the)Tj
1.4683 0 Td
(damage)Tj
3.3165 0 Td
(done.)Tj
2.4491 0 Td
(Most)Tj
2.2734 0 Td
(of)Tj
1.0091 0 Td
(the)Tj
1.4627 0 Td
(research)Tj
3.549 0 Td
(in)Tj
1.0318 0 Td
(database)Tj
3.634 0 Td
(forensics)Tj
3.7644 0 Td
(falls)Tj
1.7914 0 Td
(into)Tj
1.8369 0 Td
(this)Tj
1.6667 0 Td
(cate-)Tj
-35.6652 -1.2983 Td
(gory.)Tj
/F10 1 Tf
2.245 0 Td
[()-6()16()6()15()2()7( )]TJ
3.9628 0 Td
[( )4()22()11()22()4()-3()]TJ
/F5 1 Tf
(:)Tj
3.8948 0 Td
(We)Tj
1.61 0 Td
(refer)Tj
2.0977 0 Td
(to)Tj
1.0261 0 Td
(a)Tj
0.652 0 Td
(modified)Tj
3.8494 0 Td
(database)Tj
3.6396 0 Td
(as)Tj
1.0148 0 Td
(a)Tj
0.652 0 Td
(database)Tj
3.6397 0 Td
(which)Tj
2.6532 0 Td
(has)Tj
1.542 0 Td
(not)Tj
1.5704 0 Td
(been)Tj
-34.0495 -1.2983 Td
(compromised)Tj
5.7656 0 Td
(or)Tj
1.0941 0 Td
(damaged)Tj
3.8551 0 Td
(but)Tj
1.5534 0 Td
(has)Tj
1.5421 0 Td
(undergone)Tj
4.5637 0 Td
(changes)Tj
3.4016 0 Td
(due)Tj
1.7007 0 Td
(to)Tj
1.0262 0 Td
(normal)Tj
3.1464 0 Td
(business)Tj
3.5716 0 Td
(processes)Tj
3.9685 0 Td
(since)Tj
-35.189 -1.3039 Td
(the)Tj
1.4683 0 Td
(event)Tj
2.3697 0 Td
(of)Tj
1.0148 0 Td
(interest)Tj
3.2088 0 Td
(occurred.)Tj
4.0252 0 Td
(This)Tj
1.9842 0 Td
(category)Tj
3.6 0 Td
(of)Tj
1.0148 0 Td
(databases)Tj
3.9968 0 Td
(is)Tj
0.8504 0 Td
(often)Tj
2.2847 0 Td
(of)Tj
1.0148 0 Td
(interest)Tj
3.2088 0 Td
(when)Tj
2.4038 0 Td
(a)Tj
0.6576 0 Td
(database)Tj
3.6397 0 Td
(is)Tj
-36.7424 -1.2982 Td
(not)Tj
1.5703 0 Td
(directly)Tj
3.2372 0 Td
(involved)Tj
3.6453 0 Td
(in)Tj
1.0375 0 Td
(the)Tj
1.4683 0 Td
(crime)Tj
2.5285 0 Td
(being)Tj
2.4265 0 Td
(investigated)Tj
4.9946 0 Td
(but)Tj
1.5477 0 Td
(is)Tj
0.8504 0 Td
(used)Tj
2.0579 0 Td
(to)Tj
1.0261 0 Td
(store)Tj
2.1827 0 Td
(information)Tj
5.074 0 Td
(that)Tj
1.7801 0 Td
(may)Tj
-35.4271 -1.2983 Td
(assist)Tj
2.3017 0 Td
(in)Tj
1.0374 0 Td
(solving)Tj
3.0671 0 Td
(other)Tj
2.3471 0 Td
(crimes.)Tj
-7.5571 -1.3039 Td
(On)Tj
1.5193 0 Td
(the)Tj
1.4684 0 Td
(other)Tj
2.347 0 Td
(perspective)Tj
4.6998 0 Td
(\(forensic)Tj
3.7531 0 Td
(technology)Tj
4.6204 0 Td
(perspective\),)Tj
5.2668 0 Td
(we)Tj
1.3266 0 Td
(were)Tj
2.126 0 Td
(discovering)Tj
4.8358 0 Td
(from)Tj
2.2054 0 Td
(the)Tj
-35.3648 -1.2983 Td
(literature)Tj
3.8777 0 Td
(review)Tj
2.846 0 Td
(that)Tj
1.7745 0 Td
(most)Tj
2.2053 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(models)Tj
3.1068 0 Td
(are)Tj
1.4457 0 Td
(focusing)Tj
3.6056 0 Td
(on)Tj
1.2756 0 Td
(the)Tj
1.4683 0 Td
(technical)Tj
3.8098 0 Td
(side)Tj
1.8028 0 Td
(\(specific)Tj
3.5263 0 Td
(tools,)Tj
2.364 0 Td
(algo-)Tj
-35.5915 -1.2983 Td
(rithms,)Tj
3.0897 0 Td
(methods\).)Tj
4.2519 0 Td
(For)Tj
1.6214 0 Td
(example)Tj
3.5547 0 Td
([)Tj
0.83 0.64 0.02 0 k
(23)Tj
0 g
(])Tj
1.8481 0 Td
(have)Tj
2.058 0 Td
(been)Tj
2.126 0 Td
(offered)Tj
3.05 0 Td
(specific)Tj
3.1861 0 Td
(forensic)Tj
3.4129 0 Td
(technology)Tj
4.6205 0 Td
(and)Tj
1.7291 0 Td
(foren-)Tj
-34.5484 -1.3039 Td
(sic)Tj
1.2699 0 Td
(mechanisms)Tj
5.2043 0 Td
(to)Tj
1.0262 0 Td
(reveal)Tj
2.5738 0 Td
(Oracle)Tj
2.863 0 Td
(database)Tj
3.6397 0 Td
(activities)Tj
3.719 0 Td
(such)Tj
2.0579 0 Td
(as)Tj
1.0148 0 Td
(Log)Tj
1.7291 0 Td
(Miner,)Tj
2.9481 0 Td
(Flashback,)Tj
4.405 0 Td
(Recycle)Tj
3.2371 0 Td
(Bin,)Tj
-35.6879 -1.2982 Td
(and)Tj
1.7291 0 Td
(System)Tj
3.05 0 Td
(Change)Tj
3.2825 0 Td
(Number)Tj
3.6057 0 Td
(\(SCN\),)Tj
3.0047 0 Td
(Undo)Tj
2.5398 0 Td
(log)Tj
1.4343 0 Td
(and)Tj
1.7348 0 Td
(Redo)Tj
2.2961 0 Td
(log.)Tj
1.6667 0 Td
(Also,)Tj
2.2394 0 Td
([)Tj
0.83 0.64 0.02 0 k
(33)Tj
0 g
(])Tj
1.8538 0 Td
(offered)Tj
3.0501 0 Td
(a)Tj
0.652 0 Td
(forensic)Tj
3.4129 0 Td
(tool)Tj
-35.5519 -1.2983 Td
(called)Tj
2.5171 0 Td
(Log)Tj
2.126 0 Td
(Miner)Tj
3.1124 0 Td
(to)Tj
1.0261 0 Td
(analyse)Tj
3.1238 0 Td
(Oracle)Tj
2.863 0 Td
(database)Tj
3.6396 0 Td
(activities.)Tj
3.9402 0 Td
(Additionally,)Tj
5.4538 0 Td
(Litchfield)Tj
4.0308 0 Td
(offered)Tj
3.0444 0 Td
(series)Tj
-34.8772 -1.3039 Td
(of)Tj
1.0147 0 Td
(technical)Tj
3.8098 0 Td
(models)Tj
3.1067 0 Td
([)Tj
0.83 0.64 0.02 0 k
(25)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(34)Tj
0 g
()Tj
0.83 0.64 0.02 0 k
(39)Tj
0 g
(])Tj
4.4958 0 Td
(to)Tj
1.0261 0 Td
(deal)Tj
1.8538 0 Td
(with)Tj
1.9956 0 Td
(several)Tj
2.931 0 Td
(specific)Tj
3.1918 0 Td
(incidents,)Tj
4.1102 0 Td
(cases)Tj
2.2224 0 Td
(and)Tj
1.7348 0 Td
(scenarios)Tj
3.9118 0 Td
(of)Tj
-35.4045 -1.2983 Td
(Oracle)Tj
2.8629 0 Td
(database.)Tj
3.8665 0 Td
(Furthermore,)Tj
5.6125 0 Td
(several)Tj
2.9367 0 Td
(studies)Tj
2.9877 0 Td
(such)Tj
2.0579 0 Td
(as)Tj
1.0148 0 Td
([)Tj
0.83 0.64 0.02 0 k
(1)Tj
0 g
()Tj
0.83 0.64 0.02 0 k
(3)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(22)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(24)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(26)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(27)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(29)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(40)Tj
0 g
()Tj
0.83 0.64 0.02 0 k
(66)Tj
0 g
(],)Tj
11.1231 0 Td
(discussed)Tj
-32.4621 -1.2982 Td
(Database)Tj
3.8437 0 Td
(Forensic)Tj
3.651 0 Td
(from)Tj
2.2053 0 Td
(technology)Tj
4.6262 0 Td
(perspectives.)Tj
5.2837 0 Td
(For)Tj
1.6271 0 Td
(example,)Tj
3.7757 0 Td
(methods)Tj
3.685 0 Td
(to)Tj
1.0262 0 Td
(detect)Tj
2.6135 0 Td
(database)Tj
-32.3374 -1.2983 Td
(tampering,)Tj
4.5864 0 Td
(detect)Tj
2.6192 0 Td
(covert)Tj
2.6985 0 Td
(database)Tj
3.6397 0 Td
(server,)Tj
2.846 0 Td
(discovering)Tj
4.8415 0 Td
(who)Tj
1.9389 0 Td
(is)Tj
0.8447 0 Td
(criminal,)Tj
3.8211 0 Td
(when)Tj
2.4094 0 Td
(crime)Tj
2.5228 0 Td
(happen,)Tj
-32.7682 -1.3039 Td
(what)Tj
2.1656 0 Td
(and)Tj
1.7291 0 Td
(where)Tj
2.6476 0 Td
(crime)Tj
2.5285 0 Td
(happen,)Tj
3.4129 0 Td
(protect)Tj
3.0557 0 Td
(evidence)Tj
3.7133 0 Td
(methods,)Tj
3.9118 0 Td
(acquisition)Tj
4.6261 0 Td
(methods,)Tj
3.9118 0 Td
(analysis)Tj
3.3279 0 Td
(meth-)Tj
-35.0303 -1.2983 Td
(ods,)Tj
1.8425 0 Td
(forensic)Tj
3.4072 0 Td
(analysis)Tj
3.3278 0 Td
(algorithms,)Tj
4.7395 0 Td
(etc.)Tj
1.5931 0 Td
(have)Tj
2.0579 0 Td
(been)Tj
2.126 0 Td
(offered)Tj
3.0444 0 Td
(to)Tj
1.0261 0 Td
(deal)Tj
1.8539 0 Td
(with)Tj
1.9956 0 Td
(Database)Tj
3.8494 0 Td
(Forensic.)Tj
3.8721 0 Td
(Conse-)Tj
-34.7355 -1.2983 Td
(quently,)Tj
3.4525 0 Td
(no)Tj
1.2756 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(offered)Tj
3.0501 0 Td
(models)Tj
3.1011 0 Td
(has)Tj
1.542 0 Td
(been)Tj
2.126 0 Td
(covered)Tj
3.3505 0 Td
(whole)Tj
2.6079 0 Td
(Database)Tj
3.8494 0 Td
(Forensic)Tj
3.6453 0 Td
(domain.)Tj
3.5547 0 Td
(Some)Tj
-34.0382 -1.3039 Td
(models)Tj
3.101 0 Td
(deal)Tj
1.8539 0 Td
(with)Tj
1.9956 0 Td
(Oracle)Tj
2.8686 0 Td
(database)Tj
3.6397 0 Td
(forensic,)Tj
3.634 0 Td
(and)Tj
1.7291 0 Td
(some)Tj
2.33 0 Td
(deal)Tj
1.8539 0 Td
(with)Tj
1.9956 0 Td
(MSSQL)Tj
3.3505 0 Td
(Server)Tj
2.7382 0 Td
(forensic,)Tj
3.634 0 Td
(where)Tj
-34.7241 -1.2982 Td
(others)Tj
2.7099 0 Td
(deal)Tj
1.8481 0 Td
(with)Tj
1.9956 0 Td
(MySQL)Tj
3.3279 0 Td
(database)Tj
3.6396 0 Td
(forensic,)Tj
3.6397 0 Td
(DB2)Tj
2.0069 0 Td
(forensic)Tj
3.4129 0 Td
(and)Tj
1.7291 0 Td
(SQLite)Tj
2.9707 0 Td
(forensic.)Tj
3.634 0 Td
(However,)Tj
4.0762 0 Td
(they)Tj
-34.9906 -1.2983 Td
(are)Tj
1.4456 0 Td
(sharing)Tj
3.1975 0 Td
(in)Tj
1.0374 0 Td
(some)Tj
2.3301 0 Td
(investigation)Tj
5.3575 0 Td
(concepts)Tj
3.7247 0 Td
(and)Tj
1.7291 0 Td
(terminologies.)Tj
5.9527 0 Td
(According)Tj
4.439 0 Td
(to)Tj
1.0205 0 Td
([)Tj
0.83 0.64 0.02 0 k
(64)Tj
0 g
(])Tj
/F11 1 Tf
1.8538 0 Td
(r)Tj
/F5 1 Tf
(esearch)Tj
3.5887 0 Td
(in)Tj
-35.6766 -1.3039 Td
(digital)Tj
2.7269 0 Td
(forensics)Tj
3.77 0 Td
(has)Tj
1.5421 0 Td
(led)Tj
1.4173 0 Td
(to)Tj
1.0261 0 Td
(the)Tj
1.4683 0 Td
(development)Tj
5.4085 0 Td
(of)Tj
1.0148 0 Td
(various)Tj
3.1464 0 Td
(techniques)Tj
4.5241 0 Td
(and)Tj
1.7291 0 Td
(process)Tj
3.1862 0 Td
(models.)Tj
3.3335 0 Td
(How-)Tj
-34.2933 -1.2983 Td
(ever,)Tj
2.1146 0 Td
(many)Tj
2.4718 0 Td
(of)Tj
1.0091 0 Td
(these)Tj
2.2507 0 Td
(techniques)Tj
4.5241 0 Td
(are)Tj
1.4456 0 Td
(not)Tj
1.5704 0 Td
(completely)Tj
4.5751 0 Td
(transferable)Tj
4.9266 0 Td
(to)Tj
1.0204 0 Td
(database)Tj
3.634 0 Td
(forensics)Tj
3.7644 0 Td
(due)Tj
1.6951 0 Td
(to)Tj
1.0262 0 Td
(cer-)Tj
-36.0281 -1.2983 Td
(tain)Tj
1.7688 0 Td
(characteristics)Tj
5.9017 0 Td
(of)Tj
1.0147 0 Td
(databases)Tj
4.0025 0 Td
(which)Tj
2.6476 0 Td
(require)Tj
3.1124 0 Td
(them)Tj
2.2904 0 Td
(to)Tj
1.0261 0 Td
(be)Tj
1.1509 0 Td
(adapted)Tj
3.3789 0 Td
(for)Tj
1.3889 0 Td
(handling)Tj
3.7871 0 Td
(database)Tj
-31.47 -1.2982 Td
(forensics.)Tj
1.1962 -1.3039 Td
(Finally,)Tj
3.1747 0 Td
(the)Tj
1.4684 0 Td
(Database)Tj
3.8494 0 Td
(Forensic)Tj
3.6453 0 Td
(has)Tj
1.5421 0 Td
(been)Tj
2.1259 0 Td
(discussed)Tj
3.9969 0 Td
(from)Tj
2.2053 0 Td
(investigation)Tj
5.3631 0 Td
(process)Tj
3.1862 0 Td
(perspective.)Tj
-31.7535 -1.2983 Td
(Therefore,)Tj
4.3936 0 Td
(Investigation)Tj
5.4312 0 Td
(process)Tj
3.1861 0 Td
(model)Tj
2.7439 0 Td
(for)Tj
1.3833 0 Td
(Oracle)Tj
2.8687 0 Td
(database)Tj
3.6339 0 Td
(was)Tj
1.7008 0 Td
(offered)Tj
3.0501 0 Td
(by)Tj
1.1792 0 Td
([)Tj
0.83 0.64 0.02 0 k
(23)Tj
0 g
(])Tj
1.8538 0 Td
(to)Tj
1.0262 0 Td
(reveal)Tj
2.5738 0 Td
(mali-)Tj
-35.0246 -1.2983 Td
(cious)Tj
2.3073 0 Td
(database)Tj
3.634 0 Td
(activities.)Tj
3.9402 0 Td
(It)Tj
0.8617 0 Td
(consists)Tj
3.3449 0 Td
(of,)Tj
1.2415 0 Td
(four)Tj
1.9162 0 Td
(investigation)Tj
5.3575 0 Td
(process:)Tj
/F10 1 Tf
3.4129 0 Td
[()13()-4()10()4()2(\n)6( )]TJ
3.4242 0 Td
[( )4()22()11()22()4()-3()]TJ
3.668 0 Td
[()11()4()2()20()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
-33.1084 -1.3039 Td
[()7()10()4()4()7()-4()7()12(\n)13()]TJ
3.7984 0 Td
[( )4()22()11()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.211 0 Td
[()20()7()7()11(\n)9()7()-9()4()-4()7()12(\n)13()]TJ
5.7316 0 Td
[( )4()22()11()22()4()-3()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.8948 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[()20()8()9()11()11()-9()12(\n)13()]TJ
3.6396 0 Td
[( )4()22()11()22()4()-3()]TJ
3.6681 0 Td
[()12(\n)22()11()9()-8()-9()14()-3()]TJ
/F5 1 Tf
(.)Tj
3.702 0 Td
(Another)Tj
3.5829 0 Td
(model)Tj
2.744 0 Td
(was)Tj
-34.7015 -1.2982 Td
(developed)Tj
4.2689 0 Td
(by)Tj
1.1849 0 Td
([)Tj
0.83 0.64 0.02 0 k
(33)Tj
0 g
(])Tj
1.8482 0 Td
(to)Tj
1.0261 0 Td
(discover)Tj
3.5546 0 Td
(and)Tj
1.7291 0 Td
(analyse)Tj
3.1238 0 Td
(intruder)Tj
3.5546 0 Td
(activities)Tj
3.719 0 Td
(in)Tj
1.0319 0 Td
(MSSQL)Tj
3.3505 0 Td
(server)Tj
2.6248 0 Td
(database.)Tj
3.8665 0 Td
(It)Tj
0.856 0 Td
(con-)Tj
-35.7389 -1.2983 Td
(sists)Tj
1.8651 0 Td
(of)Tj
1.0148 0 Td
(five)Tj
1.6555 0 Td
(investigation)Tj
5.3574 0 Td
(process)Tj
3.1861 0 Td
(namely)Tj
/F10 1 Tf
3.1465 0 Td
[()92()2()-9()12()-8()4()7()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.0796 0 Td
[()34()-13()4( )4()2(\n)6()7()]TJ
3.651 0 Td
[(\r)-2()10()4()4()7()-4()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.3257 0 Td
[( )53()12()6()15()12()12(\n)6()]TJ
3.668 0 Td
[(\r)13()20()7()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
-32.9497 -1.3039 Td
[(!)28()7( )12()4()]TJ
2.7325 0 Td
[(")30(\n)6()11()15()2()10()-4()]TJ
/F5 1 Tf
(,)Tj
3.7077 0 Td
(and)Tj
/F10 1 Tf
1.7291 0 Td
[()-6()22()11()]TJ
2.1884 0 Td
[()2()7()7()12()3()2()-20()]TJ
/F5 1 Tf
(.)Tj
3.8834 0 Td
(Also,)Tj
2.245 0 Td
(two)Tj
1.7065 0 Td
(investigation)Tj
5.3631 0 Td
(processes)Tj
3.9685 0 Td
(were)Tj
2.1203 0 Td
(extracted)Tj
3.8891 0 Td
(from)Tj
2.2053 0 Td
(the)Tj
-35.7389 -1.2983 Td
(model)Tj
2.7439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(25)Tj
0 g
(],)Tj
2.0749 0 Td
(namely)Tj
/F10 1 Tf
3.1465 0 Td
[(#)31( )4()2(\n)22()7()12()-8()4()7()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.7089 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[(\r)-2()10()4()4()7()-4()7()4()11(\n)]TJ
4.0989 0 Td
[()11()20()4()7()8()10()]TJ
/F5 1 Tf
2.948 0 Td
(to)Tj
1.0261 0 Td
(identify)Tj
3.2939 0 Td
(and)Tj
1.7291 0 Td
(collect)Tj
2.7893 0 Td
(the)Tj
1.4683 0 Td
(volatile)Tj
3.0954 0 Td
(and)Tj
-35.8523 -1.2983 Td
(non-volatile)Tj
5.0513 0 Td
(data.)Tj
2.1373 0 Td
(Additionally,)Tj
5.4538 0 Td
(four)Tj
1.9162 0 Td
(investigation)Tj
5.3574 0 Td
(processes)Tj
3.9685 0 Td
(have)Tj
2.0636 0 Td
(been)Tj
2.1203 0 Td
(extracted)Tj
3.8891 0 Td
(from)Tj
2.2054 0 Td
(the)Tj
-34.1629 -1.3039 Td
(model)Tj
2.7439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(22)Tj
0 g
(])Tj
1.8481 0 Td
(to)Tj
1.0262 0 Td
(identify,)Tj
3.5206 0 Td
(verify,)Tj
2.7042 0 Td
(collect)Tj
2.7893 0 Td
(and)Tj
1.7291 0 Td
(analyse)Tj
3.1238 0 Td
(MSSQL)Tj
3.3505 0 Td
(server)Tj
2.6249 0 Td
(database)Tj
3.6396 0 Td
(incidents.)Tj
4.1102 0 Td
(The)Tj
-33.2104 -1.2982 Td
(extracted)Tj
3.8834 0 Td
(investigation)Tj
5.3631 0 Td
(processes)Tj
3.9685 0 Td
(are)Tj
/F10 1 Tf
1.4456 0 Td
[(#)39(\n)24()3()8()9()7()10()2()22()7()4()11(\n)]TJ
5.2554 0 Td
[()11()20()2()4()16()20()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.0457 0 Td
[(#)39(\n)6()1()4( )4()2(\n)22()]TJ
3.4299 0 Td
[()3()2()-9()12()-8()4()7()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.8472 0 Td
[(")30()-19()11()1()9()6()-4()]TJ
-33.2388 -1.2983 Td
[()7()10()4()4()7()-4()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.0761 0 Td
[()16(\n)6( )]TJ
1.7292 0 Td
[(")30()-19()11()1()9()6()-4()]TJ
3.3448 0 Td
[()16(\n)6()11()15()2()10()-4()]TJ
/F5 1 Tf
(.)Tj
3.5433 0 Td
(Also,)Tj
2.245 0 Td
(two)Tj
1.7065 0 Td
(investigation)Tj
5.3631 0 Td
(processes)Tj
3.9685 0 Td
(extracted)Tj
3.8834 0 Td
(from)Tj
2.2054 0 Td
(the)Tj
1.4683 0 Td
(model:)Tj
/F10 1 Tf
-33.5336 -1.2983 Td
[()-6()22()11()22()4()-3()]TJ
3.8664 0 Td
[(\r)-2()11(\n)18(\n)6()7()-4()7()4()11(\n)]TJ
4.6828 0 Td
[()16(\n)24()-13()12()20()11(\n)18()6()2(\n)22()]TJ
5.3518 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[()-16($)7()20()6()-4()7()4()11(\n)]TJ
4.3086 0 Td
[( )4()22()11()]TJ
/F5 1 Tf
1.9843 0 Td
(to)Tj
1.0261 0 Td
(detect)Tj
2.6135 0 Td
(and)Tj
1.7348 0 Td
(extract)Tj
2.931 0 Td
(malicious)Tj
4.0762 0 Td
(rela-)Tj
-34.3046 -1.3039 Td
(tions)Tj
2.1996 0 Td
(amongst)Tj
3.6567 0 Td
(tables.)Tj
2.7156 0 Td
(Other)Tj
2.5851 0 Td
(three)Tj
2.2621 0 Td
(investigation)Tj
5.3631 0 Td
(process:)Tj
/F10 1 Tf
3.4072 0 Td
[()-6()22()11()]TJ
2.1883 0 Td
[(")30()7()14()12()-4()10()14()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.8926 0 Td
[(%)-2()9()-8()12(\n)18(\n)18()12(\n)13()]TJ
4.1272 0 Td
[()11()]TJ
0.9525 0 Td
[(#)39(\n)24()3()8()9()7()]TJ
-34.35 -1.2983 Td
[()2()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.9026 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[(&)14()12(\n)6()16(\n)6()1()4()11()]TJ
3.9061 0 Td
[()16(\n)6( )]TJ
1.7292 0 Td
[(%)17()-4()10()12(\n)6()8()10()]TJ
3.4922 0 Td
[()-6()22()11()]TJ
2.1884 0 Td
[(")30(\n)6()11()15()2()10()-4()]TJ
/F5 1 Tf
3.4809 0 Td
(were)Tj
2.126 0 Td
(offered)Tj
3.0444 0 Td
(by)Tj
1.1848 0 Td
([)Tj
0.83 0.64 0.02 0 k
(44)Tj
0 g
(])Tj
1.8482 0 Td
(to)Tj
1.0261 0 Td
(detect)Tj
2.6136 0 Td
(fraud)Tj
-31.2716 -1.2982 Td
(statements.)Tj
4.7111 0 Td
(Furthermore,)Tj
5.6126 0 Td
([)Tj
0.83 0.64 0.02 0 k
(1)Tj
0 g
(])Tj
1.3776 0 Td
(offered)Tj
3.0501 0 Td
(four)Tj
1.9105 0 Td
(investigation)Tj
5.3631 0 Td
(processes)Tj
3.9685 0 Td
(to)Tj
1.0261 0 Td
(extract)Tj
2.931 0 Td
(and)Tj
1.7292 0 Td
(search)Tj
2.7609 0 Td
(meta-)Tj
-34.4407 -1.3039 Td
(data:)Tj
/F10 1 Tf
2.1373 0 Td
[(!)28()8()11()6( )4()22()11()]TJ
4.0365 0 Td
[()1($)7()20()6()-4()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.3766 0 Td
[(#)39(\n)22()11()9()-8()-9()14()-3()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.7701 0 Td
[()2()8()9()11()11()20()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.9266 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[()-6()7()16()20()13()6()22()11()4()12()14()-3()]TJ
/F5 1 Tf
(.)Tj
5.4822 0 Td
(Also,)Tj
2.2393 0 Td
(process)Tj
3.1861 0 Td
(investigation)Tj
-31.8838 -1.2983 Td
(model)Tj
2.7439 0 Td
(has)Tj
1.542 0 Td
(been)Tj
2.1203 0 Td
(introduced)Tj
4.6431 0 Td
(by)Tj
1.1849 0 Td
([)Tj
0.83 0.64 0.02 0 k
(67)Tj
0 g
(])Tj
1.8482 0 Td
(in)Tj
1.0375 0 Td
(the)Tj
1.4683 0 Td
(enterprise)Tj
4.2236 0 Td
(environment.)Tj
5.6579 0 Td
(It)Tj
0.8617 0 Td
(has)Tj
1.5421 0 Td
(clear)Tj
2.1146 0 Td
(three)Tj
2.2677 0 Td
(steps)Tj
2.1827 0 Td
(to)Tj
1.0204 0 Td
(be)Tj
-36.4589 -1.2983 Td
(taken)Tj
2.4207 0 Td
(during)Tj
2.9254 0 Td
(the)Tj
1.4683 0 Td
(investigation)Tj
5.3631 0 Td
(process)Tj
3.1861 0 Td
(starting)Tj
3.2599 0 Td
(from)Tj
/F10 1 Tf
2.2053 0 Td
[( )4()8()11()7()-4()7()4()11(\n)]TJ
3.7304 0 Td
[()-3()2()-20()3()2()]TJ
/F5 1 Tf
2.4888 0 Td
(process)Tj
3.1861 0 Td
(after)Tj
2.0353 0 Td
(the)Tj
1.4683 0 Td
(incident)Tj
-33.7377 -1.3039 Td
(reported,)Tj
3.8834 0 Td
(followed)Tj
3.651 0 Td
(by)Tj
/F10 1 Tf
1.1792 0 Td
[( )4()22()11()]TJ
1.9899 0 Td
[()7()10()4()4()7()-4()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.0762 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[()12(\n)24()3()8()9()7()10()2()22()7()4()11(\n)]TJ
5.1931 0 Td
[()11(\n)]TJ
1.2132 0 Td
[( )4()22()11()]TJ
1.9842 0 Td
[()7()10()4()4()7()-4()11()7( )]TJ
/F5 1 Tf
3.4809 0 Td
(respectively.)Tj
5.108 0 Td
(Also,)Tj
2.2451 0 Td
(a)Tj
-35.7333 -1.2982 Td
(tamper)Tj
3.084 0 Td
(detection)Tj
3.9345 0 Td
(model)Tj
2.7439 0 Td
(has)Tj
1.542 0 Td
(been)Tj
2.126 0 Td
(offered)Tj
3.0501 0 Td
(by)Tj
1.1792 0 Td
([)Tj
0.83 0.64 0.02 0 k
(52)Tj
0 g
(])Tj
1.8538 0 Td
(to)Tj
1.0205 0 Td
(introduce)Tj
4.1159 0 Td
(digital)Tj
2.7269 0 Td
(evidence)Tj
3.7133 0 Td
(against)Tj
3.0274 0 Td
(database)Tj
ET
Q
q
1 j
1 J
0 w
576 737.1 m
36 737.1 l
36 737.6 l
576 737.6 l
f*
36 741.2598 107.1496 23.6976 re
W* n
q
107.0929 0 0 23.6409 36 741.3165 cm
q
/I0 Do
Q
Q
Q
q
0 0 612 792 re
W* n
1 j
1 J
0 w
7.9999 0 0 7.9999 328.0251 745.7952 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(Developme)Tj
4.9677 0 Td
(nt)Tj
1.0417 0 Td
(and)Tj
1.8568 0 Td
(validation)Tj
4.3583 0 Td
(of)Tj
1.0417 0 Td
(a)Tj
0.7654 0 Td
(Databas)Tj
3.6567 0 Td
(e)Tj
0.7653 0 Td
(Forensic)Tj
3.9898 0 Td
(Metamodel)Tj
5.0883 0 Td
(\(DBFM\))Tj
ET
Q
q
1 j
1 J
0 w
36 48.0002 m
576 48.0002 l
576 47.5002 l
36 47.5002 l
f*
7.9999 0 0 7.9999 36 36 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(PLOS)Tj
2.8559 0 Td
(ONE)Tj
2.3669 0 Td
(|)Tj
0.4748 0 Td
(DOI:10.137)Tj
5.0387 0 Td
(1/journal.po)Tj
5.1236 0 Td
(ne.0170)Tj
3.5434 0 Td
(793)Tj
2.6362 0 Td
(February)Tj
4.1599 0 Td
(1,)Tj
1.0417 0 Td
(2017)Tj
37.8995 0 Td
(4)Tj
0.7654 0 Td
(/)Tj
ET
endstream
endobj
110 0 obj
<>stream
endstream
endobj
111 0 obj
<>stream
endstream
endobj
112 0 obj
<>stream
endstream
endobj
113 0 obj
<>stream
endstream
endobj
114 0 obj
<>stream
endstream
endobj
115 0 obj
<>stream
endstream
endobj
116 0 obj
<>stream
endstream
endobj
117 0 obj
<>stream
endstream
endobj
118 0 obj
<>stream
endstream
endobj
119 0 obj
<>stream
endstream
endobj
120 0 obj
<>stream
endstream
endobj
121 0 obj
<>stream
endstream
endobj
122 0 obj
<>stream
endstream
endobj
123 0 obj
<>stream
endstream
endobj
124 0 obj
<>stream
endstream
endobj
125 0 obj
<>stream
endstream
endobj
126 0 obj
<>stream
endstream
endobj
127 0 obj
<>stream
BT
66.402 0 Td
(34)Tj
ET
Q
endstream
endobj
128 0 obj
<>/XObject<>>>/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 10 0 R/Annots 129 0 R/Contents 130 0 R/TrimBox[0 0 612 792]>>
endobj
129 0 obj
[131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R]
endobj
131 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref003)>>
endobj
132 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref068)>>
endobj
133 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref027)>>
endobj
134 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref069)>>
endobj
135 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref086)>>
endobj
136 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref087)>>
endobj
137 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref088)>>
endobj
138 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref089)>>
endobj
130 0 obj
[139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R]
endobj
139 0 obj
<>stream
q
0.83 0.64 0.02 0 k
330.6898 680.315 m
335.452 680.315 l
h
f*
364.3087 654.3496 m
373.8331 654.3496 l
h
f*
415.389 615.3449 m
424.9134 615.3449 l
h
f*
412.5543 550.3181 m
422.0787 550.3181 l
h
f*
427.2378 550.3181 m
436.7622 550.3181 l
h
f*
386.6457 400.6488 m
396.1701 400.6488 l
h
f*
398.4378 400.6488 m
407.9055 400.6488 l
h
f*
303.4205 328.9323 m
312.8882 328.9323 l
h
f*
0 g
1 j
1 J
0 w
10 0 0 10 200.0125 707.4141 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(tamper)Tj
3.084 0 Td
(detection.)Tj
4.1613 0 Td
(Thus)Tj
2.2507 0 Td
(two)Tj
1.7064 0 Td
(investigation)Tj
5.3631 0 Td
(processes)Tj
3.9685 0 Td
(have)Tj
2.0579 0 Td
(been)Tj
2.1203 0 Td
(highlighted)Tj
4.7679 0 Td
(in)Tj
1.0318 0 Td
(this)Tj
1.6781 0 Td
(model)Tj
/F10 1 Tf
2.7439 0 Td
[()-6()8()7()10()]TJ
-34.9339 -1.3039 Td
[()-5()-13()4( )4()2(\n)6()7()]TJ
3.4922 0 Td
[()7()10()4()4()7()-4()7()4()11(\n)]TJ
3.8494 0 Td
[()-3()2()-20()3()2()]TJ
2.4888 0 Td
[()16(\n)6( )]TJ
1.7292 0 Td
[(\r)-2()10()4()4()7()-4()]TJ
2.8403 0 Td
[(')-4()20()6()13()4()]TJ
2.7609 0 Td
[()-8()4()4()]TJ
/F5 1 Tf
(.)Tj
-15.9646 -1.2982 Td
(The)Tj
1.7858 0 Td
(framework)Tj
4.6148 0 Td
(proposed)Tj
3.9514 0 Td
(by)Tj
1.1792 0 Td
([)Tj
0.83 0.64 0.02 0 k
(3)Tj
0 g
(])Tj
1.3777 0 Td
(to)Tj
1.0261 0 Td
(deal)Tj
1.8538 0 Td
(with)Tj
1.9956 0 Td
(MySQL)Tj
3.3279 0 Td
(server)Tj
2.6248 0 Td
(database.)Tj
3.8665 0 Td
(Generally,)Tj
4.3086 0 Td
(it)Tj
0.7824 0 Td
(consists)Tj
-33.8908 -1.2983 Td
(of)Tj
1.0147 0 Td
(three)Tj
2.2621 0 Td
(main)Tj
2.2904 0 Td
(investigation)Tj
5.3631 0 Td
(processes:)Tj
/F10 1 Tf
4.1896 0 Td
[(#)31( )4()2(\n)22()7()12()-8()4()7()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.7089 0 Td
[(")30()-19()11()1()9()6()-4()]TJ
3.3449 0 Td
[()7()10()4()4()7()-4()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.0762 0 Td
[()16(\n)6( )]TJ
1.7347 0 Td
[(")30()-19()11()1()9()6()-4()]TJ
3.3449 0 Td
[()16(\n)6()11()15()2()10()-4()]TJ
/F5 1 Tf
(.)Tj
-33.3295 -1.2983 Td
(Another)Tj
3.5773 0 Td
(framework)Tj
4.6147 0 Td
(has)Tj
1.5477 0 Td
(been)Tj
2.1203 0 Td
(offered)Tj
3.0501 0 Td
(by)Tj
1.1792 0 Td
([)Tj
0.83 0.64 0.02 0 k
(68)Tj
0 g
(])Tj
1.8538 0 Td
(to)Tj
1.0262 0 Td
(analyze)Tj
3.1691 0 Td
(database)Tj
3.6397 0 Td
(incidents.)Tj
4.1102 0 Td
(It)Tj
0.8617 0 Td
(consists)Tj
3.3449 0 Td
(of)Tj
1.0148 0 Td
(six)Tj
-35.1097 -1.3039 Td
(investigation)Tj
5.3574 0 Td
(processes:)Tj
/F10 1 Tf
4.1952 0 Td
[(#)39(\n)6()1()4( )4()2(\n)22()]TJ
3.4299 0 Td
[()20()2()4()11()-19()7()12(\n)13()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.0082 0 Td
[()-16($)-4()16()18()12(\n)6()22()7()4()11(\n)]TJ
5.3348 0 Td
[()11()20()2()4()16()20()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.0456 0 Td
[(\()4()24()2()10()4()7()11()]TJ
3.3959 0 Td
[(\))]TJ
0.9808 0 Td
[( )12()10()-8()14()11()11()]TJ
2.6815 0 Td
[()1($)-4()16()18()]TJ
-34.4293 -1.2982 Td
[(\n)6()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.016 0 Td
[()-6()4()1()12()6()2(\n)22()11()22()7()4()11(\n)]TJ
6.3212 0 Td
[(\))]TJ
0.9751 0 Td
[(\()2()20()8()-3()2(\n)22()11()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.3405 0 Td
[(\()23()7()9()]TJ
1.8595 0 Td
[()1($)-4()16()18()12(\n)6()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.4085 0 Td
[(\()23()7()9()]TJ
1.8595 0 Td
[()1($)-4()16()18()12(\n)6()22()7()4()11(\n)]TJ
5.1817 0 Td
[()16(\n)6()11()15()2()10()-4()]TJ
/F5 1 Tf
(.)Tj
3.5433 0 Td
(Also,)Tj
-33.5053 -1.2983 Td
(seven)Tj
2.4321 0 Td
(investigation)Tj
5.3574 0 Td
(processes)Tj
3.9685 0 Td
(have)Tj
2.0636 0 Td
(been)Tj
2.1203 0 Td
(suggested)Tj
4.0705 0 Td
(by)Tj
1.1849 0 Td
([)Tj
0.83 0.64 0.02 0 k
(27)Tj
0 g
(])Tj
1.8482 0 Td
(to)Tj
1.0261 0 Td
(investigate)Tj
4.4617 0 Td
(database)Tj
3.6397 0 Td
(incidents)Tj
-32.173 -1.3039 Td
(namely:)Tj
/F10 1 Tf
3.3732 0 Td
[()-6()8()11()2()-9()18()12(\n)6()]TJ
4.3199 0 Td
[( )4()22()11()22()4()-3()]TJ
3.6737 0 Td
[( )12()12()6()2(\n)10()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.4957 0 Td
[( )4()8()11()2()-9()18()12(\n)18()12(\n)13()]TJ
4.9379 0 Td
[()6()7()14()12()-4()10()14()7()4()11(\n)]TJ
4.5071 0 Td
[()6()8()10()6()4( )]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.3789 0 Td
[()]TJ
0.7086 0 Td
[()7()10()4()4()7()-4()7()4()11(\n)]TJ
3.8495 0 Td
[()11()]TJ
0.9524 0 Td
[()3()10()4()22()7()4()4()]TJ
-34.1969 -1.2983 Td
[()16()-19()11()1()9()6()-4()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.736 0 Td
[(\r)-2()10()4()4()7()-4()7()4()11(\n)]TJ
4.0989 0 Td
[()11()]TJ
0.9524 0 Td
[(\n)6()11(\n)3()10()4()22()7()4()4()]TJ
4.8869 0 Td
[()16()-19()11()1()9()6()-4()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.7304 0 Td
[()11()20()8()-3()2()-20()3()22()7()4()11(\n)]TJ
5.0116 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[()16()14()10()6()2(\n)22()7()4()7()22()7()4()11(\n)]TJ
5.9414 0 Td
[()11()]TJ
0.9524 0 Td
[()7()10()4()4()7()-4()11()7( )]TJ
3.4809 0 Td
[( )4()22()11()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
-34.52 -1.2983 Td
[()16(\n)6()11()15()2()10()-4()]TJ
3.3165 0 Td
[()11()]TJ
0.9524 0 Td
[()7()10()4()4()7()-4()11()7( )]TJ
3.4753 0 Td
[( )4()22()11()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.2166 0 Td
[()20()7()7()11(\n)9()7()-9()4()-4()7()4()11(\n)]TJ
5.7827 0 Td
[()11()]TJ
0.9524 0 Td
[()10()6()]TJ
1.4173 0 Td
[( )4()22()11()22()4()-3()]TJ
/F5 1 Tf
(.)Tj
-16.917 -1.3039 Td
(Recently,)Tj
3.8891 0 Td
(several)Tj
2.931 0 Td
(works)Tj
2.6419 0 Td
(have)Tj
2.0579 0 Td
(been)Tj
2.126 0 Td
(offered)Tj
3.05 0 Td
(in)Tj
1.0318 0 Td
(digital)Tj
2.7269 0 Td
(forensic.)Tj
3.634 0 Td
(However,)Tj
4.0762 0 Td
(they)Tj
1.9276 0 Td
(are)Tj
1.4456 0 Td
(mostly)Tj
-32.7342 -1.2982 Td
(focusing)Tj
3.6056 0 Td
(on)Tj
1.2756 0 Td
(cloud)Tj
2.4548 0 Td
(forensic)Tj
3.4072 0 Td
(and)Tj
1.7291 0 Td
(smartphone)Tj
5.0286 0 Td
(forensic)Tj
3.4129 0 Td
([)Tj
0.83 0.64 0.02 0 k
(69)Tj
0 g
()Tj
0.83 0.64 0.02 0 k
(86)Tj
0 g
(].)Tj
3.5433 0 Td
(They)Tj
2.2394 0 Td
(mentioned)Tj
4.5807 0 Td
(Database)Tj
-31.2772 -1.2983 Td
(Forensic)Tj
3.651 0 Td
(in)Tj
1.0318 0 Td
(an)Tj
1.2018 0 Td
(indirect)Tj
3.3506 0 Td
(way.)Tj
ET
Q
q
1 j
1 J
0 w
11.9999 0 0 11.9999 200.0125 509.7259 cm
BT
/F2 1 Tf
1 TL
-0.0033 Tc
0 0 Td
(3.0)Tj
1.5921 0 Td
(Metamodelling)Tj
7.1811 0 Td
(database)Tj
4.5119 0 Td
(forensics)Tj
ET
Q
q
1 j
1 J
0 w
10 0 0 10 200.0125 492.7181 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(To)Tj
1.3379 0 Td
(construct)Tj
3.9798 0 Td
(DBFM,)Tj
3.1805 0 Td
(a)Tj
0.6519 0 Td
(group)Tj
2.6079 0 Td
(of)Tj
1.0148 0 Td
(common)Tj
3.8494 0 Td
(and)Tj
1.7291 0 Td
(repeatedly)Tj
4.337 0 Td
(used)Tj
2.0636 0 Td
(DBF)Tj
2.0636 0 Td
(concepts)Tj
3.7247 0 Td
(is)Tj
0.8447 0 Td
(first)Tj
1.8085 0 Td
(deter-)Tj
-33.1934 -1.3039 Td
(mined.)Tj
3.033 0 Td
(The)Tj
1.7801 0 Td
(concepts)Tj
3.7247 0 Td
(and)Tj
1.7292 0 Td
(their)Tj
2.1089 0 Td
(definitions)Tj
4.5241 0 Td
(of)Tj
1.0148 0 Td
(DBF)Tj
2.0636 0 Td
(are)Tj
1.4457 0 Td
(listed)Tj
2.347 0 Td
(in)Tj
1.0318 0 Td
(the)Tj
1.474 0 Td
(existing)Tj
3.3109 0 Td
(DBF)Tj
2.0693 0 Td
(literature.)Tj
4.1045 0 Td
(A)Tj
-35.7616 -1.2982 Td
(survey)Tj
2.8119 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(DBF)Tj
2.0636 0 Td
(field/domain)Tj
5.4085 0 Td
(is)Tj
0.8447 0 Td
(first)Tj
1.8085 0 Td
(conducted)Tj
4.4277 0 Td
(by)Tj
1.1792 0 Td
(studying)Tj
3.6737 0 Td
(the)Tj
1.4683 0 Td
(huge)Tj
2.1657 0 Td
(amount)Tj
3.3562 0 Td
(of)Tj
1.0148 0 Td
(existing)Tj
-32.7059 -1.2983 Td
(DBF)Tj
2.0636 0 Td
(models,)Tj
3.3278 0 Td
(frameworks,)Tj
5.2044 0 Td
(methods,)Tj
3.9118 0 Td
(approaches)Tj
4.7338 0 Td
(and)Tj
1.7291 0 Td
(techniques)Tj
4.5298 0 Td
(from)Tj
2.2053 0 Td
(three)Tj
2.262 0 Td
(perspectives)Tj
5.0627 0 Td
(\(60)Tj
1.5137 0 Td
(in)Tj
-36.544 -1.3039 Td
(total\).)Tj
2.5681 0 Td
(This)Tj
1.9843 0 Td
(gives)Tj
2.194 0 Td
(us)Tj
1.1111 0 Td
(a)Tj
0.652 0 Td
(broad)Tj
2.5682 0 Td
(knowledge)Tj
4.541 0 Td
(of)Tj
1.0148 0 Td
(DBF)Tj
2.0637 0 Td
(actions,)Tj
3.2825 0 Td
(activities,)Tj
3.9401 0 Td
(and)Tj
1.7291 0 Td
(operations.)Tj
4.6828 0 Td
(The)Tj
1.7802 0 Td
(relation-)Tj
-34.1119 -1.2983 Td
(ships)Tj
2.2506 0 Td
(are)Tj
1.4514 0 Td
(used)Tj
2.0579 0 Td
(with)Tj
2.0013 0 Td
(related)Tj
2.9423 0 Td
(common)Tj
3.8438 0 Td
(concepts.)Tj
3.9514 0 Td
(The)Tj
1.7802 0 Td
(metamodel)Tj
4.7225 0 Td
(construction)Tj
5.3007 0 Td
(development)Tj
5.4085 0 Td
(is)Tj
-35.7106 -1.2982 Td
(iterative)Tj
3.4582 0 Td
(with)Tj
1.9956 0 Td
(nonstop)Tj
3.5092 0 Td
(modification)Tj
5.3745 0 Td
(of)Tj
1.0148 0 Td
(new)Tj
1.8765 0 Td
(concepts.)Tj
3.9458 0 Td
(To)Tj
1.338 0 Td
(create)Tj
2.5965 0 Td
(the)Tj
1.4683 0 Td
(DBFM,)Tj
3.1805 0 Td
(we)Tj
1.3266 0 Td
(used)Tj
2.0636 0 Td
(the)Tj
1.4683 0 Td
(8)Tj
/F10 1 Tf
0.6973 0 Td
[()9()11()2()7()]TJ
-35.3137 -1.2983 Td
[(!)28()8()11()16()6()4( )4()15()4()12()12(\n)13()]TJ
6.0774 0 Td
[(\r)13()20()7()22()7()4()11(\n)]TJ
3.6397 0 Td
[(\()2()20()4()7()8()10()]TJ
/F5 1 Tf
3.016 0 Td
(adapted)Tj
3.3845 0 Td
(from)Tj
2.2054 0 Td
([)Tj
0.83 0.64 0.02 0 k
(87)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(88)Tj
0 g
(],)Tj
3.2541 0 Td
(which)Tj
2.6476 0 Td
(is)Tj
0.8504 0 Td
(described)Tj
4.0535 0 Td
(below.)Tj
ET
Q
q
1 j
1 J
0 w
11.9999 0 0 11.9999 200.0125 372.9826 cm
BT
/F0 1 Tf
1 TL
-0.0033 Tc
0 0 Td
(3.1)Tj
1.5921 0 Td
(Preparing)Tj
4.4977 0 Td
(knowledge)Tj
4.937 0 Td
(sources)Tj
ET
Q
q
1 j
1 J
0 w
10 0 0 10 200.0125 355.9748 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(This)Tj
1.9842 0 Td
(step)Tj
1.8198 0 Td
(involves)Tj
3.4866 0 Td
(gathering)Tj
4.0195 0 Td
(together)Tj
3.532 0 Td
(the)Tj
1.474 0 Td
(knowledge)Tj
4.541 0 Td
(sources)Tj
3.1918 0 Td
(to)Tj
1.0262 0 Td
(be)Tj
1.1508 0 Td
(used.)Tj
2.2847 0 Td
(We)Tj
1.6101 0 Td
(have)Tj
2.0579 0 Td
(undertaken)Tj
4.8246 0 Td
(a)Tj
-37.0032 -1.2982 Td
(meta-study)Tj
4.7168 0 Td
(to)Tj
1.0204 0 Td
(learn)Tj
2.2451 0 Td
(how)Tj
1.9388 0 Td
(to)Tj
1.0262 0 Td
(distinguish)Tj
4.6374 0 Td
(between)Tj
3.532 0 Td
(them.)Tj
2.5115 0 Td
(This)Tj
1.9899 0 Td
(also)Tj
1.7631 0 Td
(enhances)Tj
3.9118 0 Td
(our)Tj
1.6271 0 Td
(domain)Tj
3.3222 0 Td
(aware-)Tj
-34.2423 -1.2983 Td
(ness)Tj
1.9105 0 Td
(as)Tj
1.0148 0 Td
(recommended)Tj
6.0377 0 Td
(in)Tj
1.0375 0 Td
([)Tj
0.83 0.64 0.02 0 k
(89)Tj
0 g
(])Tj
1.8482 0 Td
(as)Tj
1.0148 0 Td
(an)Tj
1.2019 0 Td
(initial)Tj
2.5511 0 Td
(step)Tj
1.8199 0 Td
(for)Tj
1.3833 0 Td
(any)Tj
1.6611 0 Td
(metamodelling)Tj
6.2475 0 Td
(process.)Tj
3.4072 0 Td
(In)Tj
1.1112 0 Td
(total,)Tj
2.228 0 Td
(we)Tj
1.3266 0 Td
(col-)Tj
-35.8013 -1.2982 Td
(lected)Tj
2.5625 0 Td
(60)Tj
1.1678 0 Td
(DBF)Tj
2.0636 0 Td
(models)Tj
3.1068 0 Td
(from)Tj
2.2053 0 Td
(a)Tj
0.6577 0 Td
(variety)Tj
2.9196 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.474 0 Td
(following)Tj
3.9742 0 Td
(sources:)Tj
3.4242 0 Td
(journals;)Tj
3.6964 0 Td
(conference)Tj
4.6034 0 Td
(papers;)Tj
-32.8703 -1.304 Td
(organization)Tj
5.278 0 Td
(and)Tj
1.7291 0 Td
(investigation)Tj
5.3632 0 Td
(agencies')Tj
3.7814 0 Td
(organization)Tj
5.278 0 Td
(reports;)Tj
3.2995 0 Td
(online)Tj
2.761 0 Td
(investigation-related)Tj
-27.4902 -1.2982 Td
(websites;)Tj
3.77 0 Td
(books;)Tj
2.8233 0 Td
(etc.)Tj
1.5931 0 Td
(Collecting)Tj
4.3086 0 Td
(these)Tj
2.2507 0 Td
(models)Tj
3.1067 0 Td
(was)Tj
1.7008 0 Td
(performed)Tj
4.4674 0 Td
(as)Tj
1.0148 0 Td
(follows:)Tj
3.2825 0 Td
(we)Tj
1.3266 0 Td
(focused)Tj
3.2825 0 Td
(on)Tj
1.2756 0 Td
(discov-)Tj
-34.2026 -1.2983 Td
(ering)Tj
2.296 0 Td
(categories)Tj
4.1952 0 Td
(of)Tj
1.0148 0 Td
(DBF)Tj
2.0637 0 Td
(models)Tj
3.101 0 Td
(and)Tj
1.7292 0 Td
(ascertained)Tj
4.7338 0 Td
(that)Tj
1.7801 0 Td
(there)Tj
2.2621 0 Td
(are)Tj
1.4513 0 Td
(sufficient)Tj
3.9118 0 Td
(DBF)Tj
2.0636 0 Td
(models)Tj
3.1067 0 Td
(in)Tj
1.0375 0 Td
(the)Tj
1.4684 0 Td
(lit-)Tj
-36.2152 -1.3039 Td
(erature)Tj
3.067 0 Td
(to)Tj
1.0262 0 Td
(enable)Tj
2.8006 0 Td
(metamodelling)Tj
6.2475 0 Td
(to)Tj
1.0261 0 Td
(be)Tj
1.1509 0 Td
(a)Tj
0.6519 0 Td
(feasible)Tj
3.1748 0 Td
(path.)Tj
2.2224 0 Td
(We)Tj
1.6044 0 Td
(used)Tj
2.0636 0 Td
(the)Tj
1.4683 0 Td
(following)Tj
3.9798 0 Td
(academic)Tj
-30.4835 -1.2983 Td
(collections)Tj
4.473 0 Td
(of)Tj
1.0148 0 Td
(journals:)Tj
3.6963 0 Td
(Scopus;)Tj
3.2542 0 Td
(Web)Tj
2.1203 0 Td
(of)Tj
1.0148 0 Td
(Science;)Tj
3.4299 0 Td
(IEEE;)Tj
2.4945 0 Td
(Springer;)Tj
3.8834 0 Td
(Engineering)Tj
5.1193 0 Td
(Village)Tj
2.9934 0 Td
(and)Tj
1.7348 0 Td
(Goo-)Tj
-35.2287 -1.2982 Td
(gle)Tj
1.3549 0 Td
(Scholar.)Tj
3.4299 0 Td
(For)Tj
1.6271 0 Td
(this)Tj
1.6724 0 Td
(purpose,)Tj
3.668 0 Td
(we)Tj
1.3323 0 Td
(used)Tj
2.0579 0 Td
(the)Tj
1.4684 0 Td
(following)Tj
3.9798 0 Td
(search)Tj
2.7609 0 Td
(keywords:)Tj
4.269 0 Td
(`database)Tj
3.8664 0 Td
(forensic';)Tj
-31.487 -1.304 Td
(`detect)Tj
2.8402 0 Td
(covert)Tj
2.6986 0 Td
(database';)Tj
4.0762 0 Td
(`detect)Tj
2.8403 0 Td
(database)Tj
3.6397 0 Td
(tampering';)Tj
4.8075 0 Td
(`analysis)Tj
3.5489 0 Td
(database)Tj
3.6397 0 Td
(forensic';)Tj
3.8494 0 Td
(`database)Tj
-31.9405 -1.2982 Td
(forensic)Tj
3.4072 0 Td
(artefacts';)Tj
3.9911 0 Td
(`database)Tj
3.8665 0 Td
(forensic)Tj
3.4129 0 Td
(investigation';)Tj
5.7996 0 Td
(`database)Tj
3.8608 0 Td
(forensic)Tj
3.4129 0 Td
(process';)Tj
3.6226 0 Td
(and)Tj
1.7291 0 Td
(`database)Tj
-33.1027 -1.2983 Td
(tampering'.)Tj
4.8018 0 Td
(This)Tj
1.9899 0 Td
(effort)Tj
2.3981 0 Td
(led)Tj
1.4173 0 Td
(to)Tj
1.0205 0 Td
(the)Tj
1.474 0 Td
(discovery)Tj
4.0082 0 Td
(of)Tj
1.0148 0 Td
(60)Tj
1.1735 0 Td
(models,)Tj
3.3278 0 Td
(frameworks,)Tj
5.2044 0 Td
(activities,)Tj
3.9402 0 Td
(approaches,)Tj
-31.7705 -1.3039 Td
(mechanisms,)Tj
5.4198 0 Td
(and)Tj
1.7234 0 Td
(case)Tj
1.8539 0 Td
(studies.)Tj
3.2031 0 Td
(With)Tj
2.2677 0 Td
(this)Tj
1.6668 0 Td
(number,)Tj
3.6339 0 Td
(we)Tj
1.3153 0 Td
(became)Tj
3.2428 0 Td
(more)Tj
2.3358 0 Td
(confident)Tj
4.0421 0 Td
(that)Tj
1.7688 0 Td
(the)Tj
1.457 0 Td
(literature)Tj
-33.9304 -1.2983 Td
(on)Tj
1.2755 0 Td
(DBF)Tj
2.0636 0 Td
(modelling)Tj
4.269 0 Td
(is)Tj
0.8504 0 Td
(sufficiently)Tj
4.6148 0 Td
(mature)Tj
3.0897 0 Td
(to)Tj
1.0261 0 Td
(apply)Tj
2.3925 0 Td
(a)Tj
0.6519 0 Td
(metamodelling)Tj
6.2475 0 Td
(process.)Tj
3.4073 0 Td
(We)Tj
1.61 0 Td
(categorized)Tj
-31.4983 -1.2982 Td
(these)Tj
2.2506 0 Td
(60)Tj
1.1736 0 Td
(models)Tj
3.1067 0 Td
(according)Tj
4.1839 0 Td
(to)Tj
1.0262 0 Td
(the)Tj
1.4683 0 Td
(following)Tj
3.9798 0 Td
(three)Tj
2.2677 0 Td
(different)Tj
3.6567 0 Td
(primary)Tj
3.4526 0 Td
(perspectives:)Tj
5.2894 0 Td
(i\))Tj
0.8277 0 Td
(Database)Tj
-32.6832 -1.2983 Td
(Forensic)Tj
3.651 0 Td
(Dimensions-based)Tj
7.6591 0 Td
(\(e.g.,)Tj
2.126 0 Td
(destroyed,)Tj
4.3426 0 Td
(compromised,)Tj
5.9868 0 Td
(and)Tj
1.7291 0 Td
(changed\);)Tj
4.1385 0 Td
(ii\))Tj
1.0942 0 Td
(Database)Tj
3.8494 0 Td
(Foren-)Tj
-34.5767 -1.3039 Td
(sic)Tj
1.2642 0 Td
(Technology-based)Tj
7.5344 0 Td
(\(e.g.,)Tj
2.1203 0 Td
(tools,)Tj
2.3584 0 Td
(algorithms,)Tj
4.7339 0 Td
(and)Tj
1.7291 0 Td
(methods\);)Tj
4.2406 0 Td
(and)Tj
1.7291 0 Td
(iii\))Tj
1.355 0 Td
(Database)Tj
3.8437 0 Td
(Forensic)Tj
3.6397 0 Td
(Investi-)Tj
-34.5484 -1.2983 Td
(gation)Tj
2.7382 0 Td
(Process-based)Tj
5.828 0 Td
(\(e.g.,)Tj
2.126 0 Td
(Identification,)Tj
5.8847 0 Td
(Artefact)Tj
3.4412 0 Td
(collection,)Tj
4.337 0 Td
(Artefact)Tj
3.4412 0 Td
(analysis,)Tj
-27.7963 -1.2982 Td
(Documentation)Tj
6.5593 0 Td
(and)Tj
1.7291 0 Td
(Presentation\).)Tj
-7.0922 -1.304 Td
(Collected)Tj
3.9798 0 Td
(in)Tj
1.0375 0 Td
(Step)Tj
1.9332 0 Td
(1,)Tj
0.9241 0 Td
(two)Tj
1.7064 0 Td
(sets)Tj
1.6668 0 Td
(of)Tj
1.0148 0 Td
(models)Tj
3.101 0 Td
(have)Tj
2.0637 0 Td
(been)Tj
2.1203 0 Td
(filtered)Tj
3.067 0 Td
(through)Tj
3.4469 0 Td
(for)Tj
1.3833 0 Td
(the)Tj
1.4684 0 Td
(metamodelling-)Tj
-30.1094 -1.2982 Td
(based)Tj
2.4717 0 Td
(synthesis)Tj
3.8211 0 Td
(of)Tj
1.0148 0 Td
(DBFM.)Tj
3.1861 0 Td
(This)Tj
1.9843 0 Td
(is)Tj
0.8504 0 Td
(carried)Tj
3.0387 0 Td
(out)Tj
1.5534 0 Td
(as)Tj
1.0148 0 Td
(follows.)Tj
3.2825 0 Td
(Set)Tj
1.4173 0 Td
(I)Tj
0.5612 0 Td
(is)Tj
0.8448 0 Td
(used)Tj
2.0636 0 Td
(to)Tj
1.0261 0 Td
(initiating)Tj
3.8778 0 Td
(the)Tj
ET
Q
q
1 j
1 J
0 w
576 737.1 m
36 737.1 l
36 737.6 l
576 737.6 l
f*
36 741.2598 107.1496 23.6976 re
W* n
q
107.0929 0 0 23.6409 36 741.3165 cm
q
/I0 Do
Q
Q
Q
q
0 0 612 792 re
W* n
1 j
1 J
0 w
7.9999 0 0 7.9999 328.0251 745.7952 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(Developme)Tj
4.9677 0 Td
(nt)Tj
1.0417 0 Td
(and)Tj
1.8568 0 Td
(validation)Tj
4.3583 0 Td
(of)Tj
1.0417 0 Td
(a)Tj
0.7654 0 Td
(Databas)Tj
3.6567 0 Td
(e)Tj
0.7653 0 Td
(Forensic)Tj
3.9898 0 Td
(Metamodel)Tj
5.0883 0 Td
(\(DBFM\))Tj
ET
Q
q
1 j
1 J
0 w
36 48.0002 m
576 48.0002 l
576 47.5002 l
36 47.5002 l
f*
7.9999 0 0 7.9999 36 36 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(PLOS)Tj
2.8559 0 Td
(ONE)Tj
2.3669 0 Td
(|)Tj
0.4748 0 Td
(DOI:10.137)Tj
5.0387 0 Td
(1/journal.po)Tj
5.1236 0 Td
(ne.0170)Tj
3.5434 0 Td
(793)Tj
2.6362 0 Td
(February)Tj
4.1599 0 Td
(1,)Tj
1.0417 0 Td
(2017)Tj
37.8995 0 Td
(5)Tj
0.7654 0 Td
(/)Tj
ET
endstream
endobj
140 0 obj
<>stream
endstream
endobj
141 0 obj
<>stream
endstream
endobj
142 0 obj
<>stream
endstream
endobj
143 0 obj
<>stream
endstream
endobj
144 0 obj
<>stream
endstream
endobj
145 0 obj
<>stream
endstream
endobj
146 0 obj
<>stream
endstream
endobj
147 0 obj
<>stream
endstream
endobj
148 0 obj
<>stream
endstream
endobj
149 0 obj
<>stream
BT
66.402 0 Td
(34)Tj
ET
Q
endstream
endobj
150 0 obj
<>/XObject<>>>/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 10 0 R/Annots 152 0 R/Contents 153 0 R/TrimBox[0 0 612 792]>>
endobj
152 0 obj
[154 0 R 155 0 R 156 0 R 157 0 R 158 0 R 159 0 R 160 0 R]
endobj
154 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.s001)>>
endobj
155 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref089)>>
endobj
156 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref022)>>
endobj
157 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref064)>>
endobj
158 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref024)>>
endobj
159 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref022)>>
endobj
160 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref090)>>
endobj
153 0 obj
[161 0 R 162 0 R 163 0 R 164 0 R 165 0 R 166 0 R 167 0 R 168 0 R]
endobj
161 0 obj
<>stream
q
0.83 0.64 0.02 0 k
459.8929 615.3449 m
516.6992 615.3449 l
h
f*
386.4756 511.3134 m
395.9433 511.3134 l
h
f*
333.5811 498.3307 m
343.1055 498.3307 l
h
f*
391.0677 485.348 m
400.5921 485.348 l
h
f*
521.7449 302.9102 m
531.2693 302.9102 l
h
f*
275.1874 263.9055 m
284.7118 263.9055 l
h
f*
503.263 172.9134 m
512.7874 172.9134 l
h
f*
0 g
1 j
1 J
0 w
10 0 0 10 200.0125 707.4141 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(metamodelling)Tj
6.2475 0 Td
(process,)Tj
3.4072 0 Td
(and)Tj
1.7291 0 Td
(this)Tj
1.6781 0 Td
(includes)Tj
3.5433 0 Td
(18)Tj
1.1735 0 Td
(models)Tj
3.1011 0 Td
(that)Tj
1.7802 0 Td
(cover)Tj
2.3981 0 Td
(three)Tj
2.2677 0 Td
(perspectives)Tj
5.0626 0 Td
(of)Tj
1.0148 0 Td
(DBF.)Tj
-33.4032 -1.3039 Td
(Another)Tj
3.5773 0 Td
(set,)Tj
1.5306 0 Td
(Set)Tj
1.4174 0 Td
(II,)Tj
1.1225 0 Td
(is)Tj
0.8504 0 Td
(used)Tj
2.0579 0 Td
(to)Tj
1.0261 0 Td
(undertake)Tj
4.2747 0 Td
(validation)Tj
4.2009 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.474 0 Td
(DBFM)Tj
2.9537 0 Td
(\(Step)Tj
2.2733 0 Td
(8)Tj
0.6974 0 Td
(in)Tj
1.0374 0 Td
(the)Tj
1.4684 0 Td
(process\).)Tj
3.7473 0 Td
(The)Tj
-34.7241 -1.2982 Td
(sets)Tj
1.661 0 Td
(are)Tj
1.4514 0 Td
(formed)Tj
3.1577 0 Td
(according)Tj
4.184 0 Td
(to)Tj
1.0261 0 Td
(how)Tj
1.9389 0 Td
(broadly)Tj
3.2711 0 Td
(they)Tj
1.9219 0 Td
(cover)Tj
2.3981 0 Td
(the)Tj
1.474 0 Td
(three)Tj
2.2621 0 Td
(perspectives)Tj
5.0626 0 Td
(of)Tj
1.0148 0 Td
(DBF.)Tj
2.2904 0 Td
(Some)Tj
-33.1141 -1.2983 Td
(models)Tj
3.101 0 Td
(cover)Tj
2.4038 0 Td
(all)Tj
1.1452 0 Td
(three)Tj
2.262 0 Td
(perspectives,)Tj
5.2894 0 Td
(some)Tj
2.3301 0 Td
(cover)Tj
2.4038 0 Td
(2)Tj
0.6916 0 Td
(perspectives,)Tj
5.2894 0 Td
(while)Tj
2.3698 0 Td
(others)Tj
2.7099 0 Td
(focus)Tj
2.3244 0 Td
(on)Tj
1.2756 0 Td
(only)Tj
1.9785 0 Td
(one)Tj
-35.5745 -1.2983 Td
(perspective.)Tj
4.9265 0 Td
(Some)Tj
2.4435 0 Td
(models)Tj
3.1067 0 Td
(focus)Tj
2.3244 0 Td
(on)Tj
1.2756 0 Td
(a)Tj
0.6576 0 Td
(specific)Tj
3.1862 0 Td
(DBF)Tj
2.0692 0 Td
(perspective)Tj
4.6999 0 Td
(and)Tj
1.7291 0 Td
(do)Tj
1.2529 0 Td
(not)Tj
1.576 0 Td
(pay)Tj
1.6271 0 Td
(too)Tj
1.5307 0 Td
(much)Tj
2.5172 0 Td
(atten-)Tj
-34.9226 -1.3039 Td
(tion)Tj
1.8425 0 Td
(to)Tj
1.0204 0 Td
(the)Tj
1.474 0 Td
(boundaries)Tj
4.6942 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(DBF)Tj
2.0636 0 Td
(perspectives)Tj
5.0627 0 Td
(\(e.g.,)Tj
2.1259 0 Td
(reconstruction)Tj
6.0945 0 Td
(events)Tj
2.7326 0 Td
(\(technology-)Tj
-29.5935 -1.2982 Td
(based\)\).)Tj
3.3788 0 Td
(If)Tj
0.8447 0 Td
(a)Tj
0.6577 0 Td
(model)Tj
2.7439 0 Td
(does)Tj
2.0353 0 Td
(not)Tj
1.576 0 Td
(cover)Tj
2.3981 0 Td
(any)Tj
1.6611 0 Td
(DBF)Tj
2.0636 0 Td
(perspective,)Tj
4.9266 0 Td
(we)Tj
1.3266 0 Td
(exclude)Tj
3.2542 0 Td
(it)Tj
0.788 0 Td
(from)Tj
2.2053 0 Td
(any)Tj
1.6554 0 Td
(further)Tj
3.0274 0 Td
(investi-)Tj
-34.5427 -1.2983 Td
(gation.)Tj
2.965 0 Td
(The)Tj
1.7801 0 Td
(models)Tj
3.1068 0 Td
(included)Tj
3.7133 0 Td
(in)Tj
1.0318 0 Td
(each)Tj
2.0296 0 Td
(set)Tj
1.304 0 Td
(are)Tj
1.4513 0 Td
(shown)Tj
2.846 0 Td
(in)Tj
1.0374 0 Td
(\(Table)Tj
2.778 0 Td
(A)Tj
0.907 0 Td
(in)Tj
0.83 0.64 0.02 0 k
1.0375 0 Td
(S1)Tj
1.1679 0 Td
(Appendix)Tj
4.1726 0 Td
(I)Tj
0 g
(\).)Tj
-30.1321 -1.3039 Td
(For)Tj
1.627 0 Td
(Set)Tj
1.4174 0 Td
(I,)Tj
0.788 0 Td
(we)Tj
1.3266 0 Td
(require)Tj
3.1124 0 Td
(wide)Tj
2.1203 0 Td
(coverage)Tj
3.7247 0 Td
(across)Tj
2.6759 0 Td
(the)Tj
1.4683 0 Td
(concepts)Tj
3.7247 0 Td
(as)Tj
1.0148 0 Td
(our)Tj
1.6271 0 Td
(aim)Tj
1.7405 0 Td
(is)Tj
0.8447 0 Td
(to)Tj
1.0261 0 Td
(create)Tj
2.5965 0 Td
(a)Tj
0.652 0 Td
(DBFM)Tj
2.9594 0 Td
(that)Tj
-35.6426 -1.2983 Td
(can)Tj
1.627 0 Td
(be)Tj
1.1509 0 Td
(widely)Tj
2.8233 0 Td
(applicable.)Tj
4.456 0 Td
(Using)Tj
2.6022 0 Td
(the)Tj
1.4683 0 Td
(coverage)Tj
3.7247 0 Td
(measure)Tj
3.5773 0 Td
(alone,)Tj
2.6079 0 Td
(we)Tj
1.3266 0 Td
(quickly)Tj
3.1408 0 Td
(gain)Tj
1.9332 0 Td
(an)Tj
1.2075 0 Td
(indication)Tj
4.3087 0 Td
(of)Tj
-35.9544 -1.2983 Td
(how)Tj
1.9388 0 Td
(widely)Tj
2.8233 0 Td
(applicable)Tj
4.235 0 Td
(the)Tj
1.4683 0 Td
(sourced)Tj
3.3619 0 Td
(model)Tj
2.7439 0 Td
(is.)Tj
1.0771 0 Td
(The)Tj
1.7802 0 Td
(model)Tj
2.7439 0 Td
(is)Tj
0.8504 0 Td
(said)Tj
1.8085 0 Td
(to)Tj
1.0261 0 Td
(have)Tj
2.058 0 Td
(a)Tj
0.6519 0 Td
(high)Tj
2.0069 0 Td
(coverage)Tj
3.7247 0 Td
(value)Tj
2.3074 0 Td
(if)Tj
-36.6063 -1.3039 Td
(it)Tj
0.7823 0 Td
(can)Tj
1.6271 0 Td
(cover)Tj
2.3981 0 Td
(the)Tj
1.474 0 Td
(entire)Tj
2.5512 0 Td
(perspective)Tj
4.6998 0 Td
(of)Tj
1.0148 0 Td
(DBF)Tj
2.0636 0 Td
(\()Tj
/F10 1 Tf
[()2()2(\n)6()2()20()11()]TJ
3.3675 0 Td
[()6()4( )4()15()]TJ
/F5 1 Tf
(\),)Tj
3.1521 0 Td
(whereas)Tj
3.4469 0 Td
(a)Tj
0.6577 0 Td
(model)Tj
2.7439 0 Td
(has)Tj
1.542 0 Td
(a)Tj
0.652 0 Td
(lower)Tj
2.4548 0 Td
(cover-)Tj
-34.6278 -1.2982 Td
(age)Tj
1.542 0 Td
(value)Tj
2.3074 0 Td
(if)Tj
0.771 0 Td
(it)Tj
0.788 0 Td
(only)Tj
1.9786 0 Td
(describes)Tj
3.8834 0 Td
(a)Tj
0.652 0 Td
(specific)Tj
3.1918 0 Td
(DBF)Tj
2.0636 0 Td
(perspective,)Tj
4.9266 0 Td
(such)Tj
2.0579 0 Td
(as)Tj
1.0148 0 Td
(forensic)Tj
3.4129 0 Td
(techniques)Tj
4.5297 0 Td
(\()Tj
/F10 1 Tf
[()10()4()7()1()12()-8()4()]TJ
-33.1197 -1.2983 Td
[()6()4( )4()15()]TJ
/F5 1 Tf
(\).)Tj
3.1521 0 Td
(As)Tj
1.2642 0 Td
(supported)Tj
4.2689 0 Td
(by)Tj
1.1793 0 Td
(Kelly)Tj
/F10 1 Tf
2.2677 0 Td
[()8()]TJ
0.907 0 Td
[()11()]TJ
/F5 1 Tf
(.)Tj
1.1679 0 Td
(in)Tj
1.0318 0 Td
(their)Tj
2.109 0 Td
(discussion)Tj
4.371 0 Td
(regarding)Tj
4.0932 0 Td
(practices)Tj
3.736 0 Td
(for)Tj
1.389 0 Td
(the)Tj
1.4683 0 Td
(development)Tj
-32.4054 -1.3039 Td
(of)Tj
1.0147 0 Td
(domain-specific)Tj
6.6444 0 Td
(modelling,)Tj
4.4957 0 Td
()Tj
/F10 1 Tf
[(&)14()12(\n)6( )12()12(\n)13()]TJ
3.6284 0 Td
[()10()6()]TJ
1.4173 0 Td
[()11()20()11()4()2()]TJ
2.7496 0 Td
[()2()2(\n)6()2()-9()4()10()4()7()1()12()-8()4()]TJ
6.015 0 Td
[()4()11()4()16(\n)6()7()]TJ
3.1975 0 Td
[()-4()]TJ
0.8164 0 Td
[()]TJ
0.7086 0 Td
[(*)8()-5()10()4()7()7()8()10()]TJ
4.4901 0 Td
[()9()6()-4()11()11()]TJ
-35.1777 -1.2983 Td
[()12(\n)]TJ
1.0147 0 Td
[( )4()11()6()16()12(\n)10()4()7()1()12()-8()4()]TJ
6.3099 0 Td
[()6()4( )4()15()4()12()12(\n)13()]TJ
4.0309 0 Td
[( )4()-5()3()15()4()11()11()6()2(\n)22()]TJ
/F12 1 Tf
0 Tc
(.)Tj
5.3234 0 Td
(.)Tj
0.4309 0 Td
(.)Tj
/F10 1 Tf
-0.004 Tc
[(+)]TJ
0.8617 0 Td
[()]TJ
/F5 1 Tf
([)Tj
0.83 0.64 0.02 0 k
(89)Tj
0 g
(])Tj
/F10 1 Tf
2.1827 0 Td
[()11()]TJ
/F5 1 Tf
(.)Tj
/F10 1 Tf
1.4003 0 Td
[(,-)]TJ
/F5 1 Tf
(.)Tj
1.6951 0 Td
(For)Tj
1.6214 0 Td
(example,)Tj
3.7757 0 Td
(the)Tj
1.4683 0 Td
(`SQL)Tj
2.2054 0 Td
(Server)Tj
-32.3204 -1.2982 Td
(Forensic)Tj
3.651 0 Td
(Analysis)Tj
3.5716 0 Td
(Methodology')Tj
5.794 0 Td
([)Tj
0.83 0.64 0.02 0 k
(22)Tj
0 g
(])Tj
1.8538 0 Td
(could)Tj
2.4491 0 Td
(cover)Tj
2.3981 0 Td
(most)Tj
2.211 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4684 0 Td
(DBF)Tj
2.0636 0 Td
(aspect)Tj
2.6759 0 Td
(in)Tj
1.0374 0 Td
(the)Tj
1.4684 0 Td
(model,)Tj
-31.6571 -1.2983 Td
(whereas)Tj
3.4412 0 Td
(`Reconstruction)Tj
6.5763 0 Td
(in)Tj
1.0318 0 Td
(Database)Tj
3.8495 0 Td
(Forensic')Tj
3.8664 0 Td
([)Tj
0.83 0.64 0.02 0 k
(64)Tj
0 g
(])Tj
1.8482 0 Td
(covers)Tj
2.7609 0 Td
(only)Tj
1.9786 0 Td
(a)Tj
0.6519 0 Td
(small)Tj
2.3301 0 Td
(portion)Tj
3.2371 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4684 0 Td
(DBF)Tj
-34.0552 -1.3039 Td
(domain.)Tj
3.5489 0 Td
(In)Tj
1.1055 0 Td
(the)Tj
1.474 0 Td
(selection)Tj
3.719 0 Td
(of)Tj
1.0148 0 Td
(models)Tj
3.1011 0 Td
(for)Tj
1.389 0 Td
(Set)Tj
1.4173 0 Td
(I,)Tj
0.7824 0 Td
(we)Tj
1.3322 0 Td
(ensured)Tj
3.4016 0 Td
(that)Tj
1.7801 0 Td
(selected)Tj
3.3449 0 Td
(models)Tj
3.1068 0 Td
(can)Tj
1.6214 0 Td
(cover)Tj
2.4037 0 Td
(three)Tj
-34.5427 -1.2983 Td
(\(3\))Tj
1.3719 0 Td
(perspectives)Tj
5.0627 0 Td
(in)Tj
1.0374 0 Td
(DBF)Tj
2.0636 0 Td
(\(Database)Tj
4.1896 0 Td
(Forensic)Tj
3.651 0 Td
(Dimensions,)Tj
5.2838 0 Td
(Database)Tj
3.8437 0 Td
(Forensic)Tj
3.651 0 Td
(Technology,)Tj
5.159 0 Td
(and)Tj
-35.3137 -1.2983 Td
(Database)Tj
3.8437 0 Td
(Forensic)Tj
3.651 0 Td
(Investigation)Tj
5.4368 0 Td
(Process\).)Tj
3.7871 0 Td
(The)Tj
1.7858 0 Td
(initial)Tj
2.5455 0 Td
(metamodel)Tj
4.7225 0 Td
(development)Tj
5.4085 0 Td
(requires)Tj
3.4752 0 Td
(the)Tj
-34.6561 -1.3039 Td
(combination)Tj
5.3461 0 Td
(of)Tj
1.0148 0 Td
(all)Tj
1.1451 0 Td
(generic)Tj
3.1465 0 Td
(concepts)Tj
3.719 0 Td
(existing)Tj
3.3165 0 Td
(in)Tj
1.0375 0 Td
(the)Tj
1.4683 0 Td
(domain.)Tj
3.549 0 Td
(The)Tj
1.7801 0 Td
(combination)Tj
5.3518 0 Td
(of)Tj
1.0148 0 Td
(concepts)Tj
3.719 0 Td
(that)Tj
-35.6085 -1.2982 Td
(come)Tj
2.3924 0 Td
(from)Tj
2.2053 0 Td
(all)Tj
1.1452 0 Td
(DBF)Tj
2.0636 0 Td
(perspectives)Tj
5.0627 0 Td
(will)Tj
1.6667 0 Td
(provide)Tj
3.2882 0 Td
(generic)Tj
3.1408 0 Td
(concepts)Tj
3.7247 0 Td
(for)Tj
1.3833 0 Td
(our)Tj
1.627 0 Td
(DBFM.)Tj
ET
Q
q
1 j
1 J
0 w
11.9999 0 0 11.9999 200.0125 386.022 cm
BT
/F0 1 Tf
1 TL
-0.0033 Tc
0 0 Td
(3.2)Tj
1.5921 0 Td
(Recognize)Tj
4.8851 0 Td
(and)Tj
1.8661 0 Td
(extract)Tj
3.1937 0 Td
(general)Tj
3.5056 0 Td
(concepts)Tj
ET
Q
q
1 j
1 J
0 w
10 0 0 10 200.0125 369.0141 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(Extraction)Tj
4.3993 0 Td
(of)Tj
1.0148 0 Td
(concepts)Tj
3.7247 0 Td
(from)Tj
2.2053 0 Td
(a)Tj
0.652 0 Td
(textual)Tj
2.914 0 Td
(model)Tj
2.7439 0 Td
(must)Tj
2.228 0 Td
(comply)Tj
3.1918 0 Td
(with)Tj
1.9956 0 Td
(tight)Tj
2.0749 0 Td
(conditions)Tj
4.4788 0 Td
(to)Tj
1.0204 0 Td
(avoid)Tj
2.4151 0 Td
(any)Tj
-35.0586 -1.3039 Td
(missing)Tj
3.2995 0 Td
(or)Tj
1.0885 0 Td
(unrelated)Tj
4.0138 0 Td
(concepts)Tj
3.7133 0 Td
(that)Tj
1.7689 0 Td
(may)Tj
1.9162 0 Td
(cause)Tj
2.3811 0 Td
(doubt)Tj
2.5795 0 Td
(or)Tj
1.0885 0 Td
(confusion)Tj
4.1895 0 Td
(later.)Tj
2.2111 0 Td
(Therefore,)Tj
4.3823 0 Td
(the)Tj
1.457 0 Td
(concepts)Tj
-34.0892 -1.2982 Td
(should)Tj
2.9139 0 Td
(be)Tj
1.1509 0 Td
(extracted)Tj
3.8891 0 Td
(from)Tj
2.2054 0 Td
(the)Tj
1.4683 0 Td
(main)Tj
2.2904 0 Td
(body)Tj
2.2167 0 Td
(of)Tj
1.0147 0 Td
(the)Tj
1.4684 0 Td
(textual)Tj
2.914 0 Td
(model;)Tj
2.9707 0 Td
(this)Tj
1.6724 0 Td
(means)Tj
2.8063 0 Td
(excluding)Tj
4.1159 0 Td
(the)Tj
1.4683 0 Td
(title,)Tj
-34.5654 -1.2983 Td
(abstract,)Tj
3.5716 0 Td
(introduction,)Tj
5.5388 0 Td
(related)Tj
2.9424 0 Td
(works,)Tj
2.8686 0 Td
(and)Tj
1.7292 0 Td
(conclusion.)Tj
4.8018 0 Td
(The)Tj
1.7858 0 Td
(main)Tj
2.2904 0 Td
(body)Tj
2.2167 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(textual)Tj
2.914 0 Td
(model)Tj
-33.1424 -1.2983 Td
(explains)Tj
3.4809 0 Td
(the)Tj
1.4683 0 Td
(perspective)Tj
4.7055 0 Td
(of)Tj
1.0148 0 Td
(researchers,)Tj
4.9322 0 Td
(developers,)Tj
4.7055 0 Td
(or)Tj
1.0942 0 Td
(experts)Tj
3.0841 0 Td
(as)Tj
1.0148 0 Td
(to)Tj
1.0261 0 Td
(the)Tj
1.4683 0 Td
(main)Tj
2.2904 0 Td
(clue)Tj
1.8369 0 Td
(of)Tj
1.0147 0 Td
(this)Tj
1.6781 0 Td
(model.)Tj
-34.8148 -1.3039 Td
(For)Tj
1.627 0 Td
(example,)Tj
3.7701 0 Td
(Lee's)Tj
2.1826 0 Td
(model)Tj
2.744 0 Td
(A)Tj
1.2982 0 Td
(Workflow)Tj
4.286 0 Td
(to)Tj
1.0261 0 Td
(Support)Tj
3.4299 0 Td
(Forensic)Tj
3.651 0 Td
(Database)Tj
3.8494 0 Td
(Analysis)Tj
3.9685 0 Td
([)Tj
0.83 0.64 0.02 0 k
(24)Tj
0 g
(])Tj
1.8482 0 Td
(is)Tj
0.8504 0 Td
(a)Tj
0.652 0 Td
(work-)Tj
-35.1834 -1.2982 Td
(flow)Tj
1.9445 0 Td
(model)Tj
2.7439 0 Td
(for)Tj
1.3833 0 Td
(Database)Tj
3.8494 0 Td
(Forensics)Tj
4.0139 0 Td
(that)Tj
1.7745 0 Td
(offers)Tj
2.4604 0 Td
(six)Tj
1.3153 0 Td
(\(6\))Tj
1.3719 0 Td
(processes;)Tj
4.1953 0 Td
(hence,)Tj
2.7949 0 Td
(the)Tj
1.4684 0 Td
(authors)Tj
3.2485 0 Td
(focus)Tj
2.3243 0 Td
(on)Tj
1.2756 0 Td
(the)Tj
-36.1641 -1.2983 Td
(related)Tj
2.9423 0 Td
(concepts)Tj
3.7247 0 Td
(of)Tj
1.0148 0 Td
(these)Tj
2.2507 0 Td
(processes.)Tj
4.1952 0 Td
(Additionally,)Tj
5.4539 0 Td
(Fowler's)Tj
3.5546 0 Td
(model,)Tj
2.9707 0 Td
(SQL)Tj
2.3754 0 Td
(Server)Tj
2.7382 0 Td
(Forensic)Tj
3.651 0 Td
(Analy-)Tj
-34.8715 -1.3039 Td
(sis)Tj
1.2075 0 Td
(Methodology)Tj
5.9697 0 Td
([)Tj
0.83 0.64 0.02 0 k
(22)Tj
0 g
(],)Tj
2.075 0 Td
(offered)Tj
3.05 0 Td
(forensic)Tj
3.4073 0 Td
(methodologies)Tj
6.1057 0 Td
(that)Tj
1.7745 0 Td
(covered)Tj
3.3506 0 Td
(the)Tj
1.474 0 Td
(Microsoft)Tj
4.1328 0 Td
(SQL)Tj
1.9786 0 Td
(Server)Tj
-34.5257 -1.2983 Td
(Database)Tj
3.8437 0 Td
(and)Tj
1.7348 0 Td
(proposed)Tj
3.9515 0 Td
(four)Tj
1.9105 0 Td
(processes,)Tj
4.1953 0 Td
(namely)Tj
/F10 1 Tf
3.1464 0 Td
[(#)39(\n)24()3()8()9()7()10()2()22()7()4()11(\n)]TJ
5.2554 0 Td
[()11()20()2()4()16()20()7( )12(\n)6()8()10(.)]TJ
5.4652 0 Td
[()92()2()-9()12()-8()4()7()22()7()4()11(\n)]TJ
4.8528 0 Td
[()12(\n)6()1()]TJ
-34.3556 -1.2983 Td
[( )4()2(\n)22(.)]TJ
2.1599 0 Td
[(")30()-19()11()1()9()6()-4()]TJ
3.3449 0 Td
[()7()10()4()4()7()-4()7()4()11(\n.)]TJ
4.0762 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[(")30()-19()11()1()9()6()-4()]TJ
3.3505 0 Td
[()16(\n)6()11()15()2()10()-4()]TJ
/F5 1 Tf
(.)Tj
-13.4644 -1.3039 Td
(Therefore,)Tj
4.3936 0 Td
(authors)Tj
3.2485 0 Td
(recognize)Tj
4.0649 0 Td
(the)Tj
1.4683 0 Td
(concepts)Tj
3.719 0 Td
(contained)Tj
4.201 0 Td
(under)Tj
2.6192 0 Td
(these)Tj
2.2507 0 Td
(processes.)Tj
4.1952 0 Td
(With)Tj
2.279 0 Td
(regard)Tj
2.812 0 Td
(to)Tj
-36.4476 -1.2982 Td
(the)Tj
1.4683 0 Td
(other)Tj
2.3471 0 Td
(criteria,)Tj
3.3051 0 Td
(recognized)Tj
4.5865 0 Td
(concepts)Tj
3.7247 0 Td
(must)Tj
2.228 0 Td
(be)Tj
1.1508 0 Td
(nouns)Tj
2.7099 0 Td
(or)Tj
1.0999 0 Td
(\(adjective)Tj
4.0705 0 Td
(+)Tj
0.7994 0 Td
(noun\).)Tj
2.914 0 Td
(For)Tj
1.627 0 Td
(example,)Tj
/F10 1 Tf
-32.0312 -1.2983 Td
[()-6()22()11()22()4()-3()]TJ
3.8664 0 Td
[()-3()2()-20()3()2()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.7156 0 Td
[(#)39(\n)24()3()8()9()7()10()2()22()7()4()11(\n)]TJ
5.2554 0 Td
[( )97()7()16()]TJ
/F5 1 Tf
(,)Tj
2.6929 0 Td
(and)Tj
/F10 1 Tf
1.7291 0 Td
[(&)31()11()20()2(\n)10()4()]TJ
3.4526 0 Td
[( )97()7()13()18(\n)18()4()14()4()]TJ
/F5 1 Tf
4.2689 0 Td
(are)Tj
1.4513 0 Td
(nouns,)Tj
2.9367 0 Td
(whereas)Tj
/F10 1 Tf
3.4469 0 Td
[()92()10()4()22()7()4()4()]TJ
3.2655 0 Td
[(")30()-19()11()]TJ
-35.0813 -1.3039 Td
[()9()6()-4()]TJ
/F5 1 Tf
(,)Tj
1.8651 0 Td
(and)Tj
/F10 1 Tf
1.7348 0 Td
[(/)28()11(\n)3()10()4()22()7()4()4()]TJ
5.0513 0 Td
[()16()-19()11()1()9()6()-4()]TJ
/F5 1 Tf
3.1805 0 Td
(is)Tj
0.8447 0 Td
(adjective+noun.)Tj
7.4494 0 Td
(Additionally,)Tj
5.4538 0 Td
(the)Tj
1.474 0 Td
(third)Tj
2.211 0 Td
(criterion)Tj
3.6964 0 Td
(that)Tj
1.7801 0 Td
(may)Tj
-34.7411 -1.2983 Td
(follow)Tj
2.6985 0 Td
(excludes)Tj
3.617 0 Td
(any)Tj
1.6554 0 Td
(concept)Tj
3.3619 0 Td
(that)Tj
1.7801 0 Td
(is)Tj
0.8504 0 Td
(not)Tj
1.5704 0 Td
(related)Tj
2.948 0 Td
(to)Tj
1.0205 0 Td
(the)Tj
1.474 0 Td
(domain.)Tj
3.5489 0 Td
(According)Tj
4.4391 0 Td
(to)Tj
1.0204 0 Td
([)Tj
0.83 0.64 0.02 0 k
(90)Tj
0 g
(],)Tj
2.0807 0 Td
(the)Tj
1.4683 0 Td
(golden)Tj
-33.5336 -1.2982 Td
(rule)Tj
1.7858 0 Td
(for)Tj
1.3889 0 Td
(selecting)Tj
3.6737 0 Td
(concepts)Tj
3.7247 0 Td
(is)Tj
0.8504 0 Td
(if)Tj
1.1622 0 Td
(it)Tj
0.788 0 Td
(is)Tj
0.8504 0 Td
(not)Tj
1.5704 0 Td
(relevant)Tj
3.4242 0 Td
(to)Tj
1.0205 0 Td
(the)Tj
1.474 0 Td
(domain,)Tj
3.549 0 Td
(then)Tj
2.0182 0 Td
(do)Tj
1.2529 0 Td
(not)Tj
1.5761 0 Td
(include)Tj
3.1804 0 Td
(it)Tj
0.788 0 Td
(in)Tj
1.0375 0 Td
(the)Tj
-35.1153 -1.2983 Td
(case)Tj
1.8595 0 Td
(domain)Tj
3.3221 0 Td
(model.)Tj
3.3619 0 Td
(The)Tj
1.7858 0 Td
(case)Tj
1.8595 0 Td
(domain)Tj
3.3279 0 Td
(model)Tj
2.7439 0 Td
(should)Tj
2.914 0 Td
(not)Tj
1.5761 0 Td
(be)Tj
1.1508 0 Td
(a)Tj
0.652 0 Td
(comprehensive)Tj
6.2872 0 Td
(representation)Tj
-30.8407 -1.3039 Td
(of)Tj
1.0147 0 Td
(all)Tj
1.1452 0 Td
(entities/concepts)Tj
6.9392 0 Td
(involved)Tj
3.651 0 Td
(in)Tj
1.0375 0 Td
(a)Tj
0.6519 0 Td
(case.)Tj
2.0863 0 Td
(Rather,)Tj
3.1238 0 Td
(the)Tj
1.4683 0 Td
(case)Tj
1.8595 0 Td
(domain)Tj
3.3279 0 Td
(model)Tj
2.7439 0 Td
(should)Tj
2.914 0 Td
(represent)Tj
3.9572 0 Td
(all)Tj
-35.9204 -1.2983 Td
(case)Tj
1.8595 0 Td
(concepts)Tj
3.7247 0 Td
(that)Tj
1.7801 0 Td
(are)Tj
1.4457 0 Td
(essential)Tj
3.5829 0 Td
(to)Tj
1.0262 0 Td
(the)Tj
1.4683 0 Td
(Database)Tj
3.8494 0 Td
(Forensics)Tj
4.0082 0 Td
(examination.)Tj
5.4595 0 Td
(In)Tj
1.1112 0 Td
(large-scale)Tj
4.3993 0 Td
(cases,)Tj
2.4435 0 Td
(it)Tj
-36.1585 -1.2983 Td
(would)Tj
2.7099 0 Td
(be)Tj
1.1508 0 Td
(especially)Tj
4.0195 0 Td
(counterproductive)Tj
7.6365 0 Td
(to)Tj
1.0261 0 Td
(model)Tj
2.744 0 Td
(every)Tj
2.347 0 Td
(involved)Tj
3.651 0 Td
(concept;)Tj
3.5887 0 Td
(even)Tj
2.0692 0 Td
(relatively)Tj
3.8381 0 Td
(simple)Tj
-34.7808 -1.3039 Td
(cases)Tj
2.2223 0 Td
(could)Tj
2.4491 0 Td
(yield)Tj
2.143 0 Td
(an)Tj
1.2019 0 Td
(unmanageable)Tj
6.0321 0 Td
(case)Tj
1.8595 0 Td
(domain)Tj
3.3278 0 Td
(model)Tj
2.744 0 Td
(if)Tj
0.771 0 Td
(all)Tj
1.1452 0 Td
(concepts)Tj
3.7247 0 Td
(are)Tj
1.4513 0 Td
(exhausted.)Tj
4.4334 0 Td
(Thus,)Tj
-33.5053 -1.2982 Td
(each)Tj
2.0295 0 Td
(step)Tj
1.8199 0 Td
(in)Tj
1.0318 0 Td
(the)Tj
1.474 0 Td
(process)Tj
3.1804 0 Td
(of)Tj
1.0148 0 Td
(constructing)Tj
5.2611 0 Td
(a)Tj
0.652 0 Td
(case)Tj
1.8652 0 Td
(domain)Tj
3.3221 0 Td
(model)Tj
2.744 0 Td
(must)Tj
2.228 0 Td
(be)Tj
1.1508 0 Td
(supported)Tj
4.269 0 Td
(by)Tj
1.1849 0 Td
(methods)Tj
ET
Q
q
1 j
1 J
0 w
576 737.1 m
36 737.1 l
36 737.6 l
576 737.6 l
f*
36 741.2598 107.1496 23.6976 re
W* n
q
107.0929 0 0 23.6409 36 741.3165 cm
q
/I0 Do
Q
Q
Q
q
0 0 612 792 re
W* n
1 j
1 J
0 w
7.9999 0 0 7.9999 328.0251 745.7952 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(Developme)Tj
4.9677 0 Td
(nt)Tj
1.0417 0 Td
(and)Tj
1.8568 0 Td
(validation)Tj
4.3583 0 Td
(of)Tj
1.0417 0 Td
(a)Tj
0.7654 0 Td
(Databas)Tj
3.6567 0 Td
(e)Tj
0.7653 0 Td
(Forensic)Tj
3.9898 0 Td
(Metamodel)Tj
5.0883 0 Td
(\(DBFM\))Tj
ET
Q
q
1 j
1 J
0 w
36 48.0002 m
576 48.0002 l
576 47.5002 l
36 47.5002 l
f*
7.9999 0 0 7.9999 36 36 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(PLOS)Tj
2.8559 0 Td
(ONE)Tj
2.3669 0 Td
(|)Tj
0.4748 0 Td
(DOI:10.137)Tj
5.0387 0 Td
(1/journal.po)Tj
5.1236 0 Td
(ne.0170)Tj
3.5434 0 Td
(793)Tj
2.6362 0 Td
(February)Tj
4.1599 0 Td
(1,)Tj
1.0417 0 Td
(2017)Tj
37.8995 0 Td
(6)Tj
0.7654 0 Td
(/)Tj
ET
endstream
endobj
162 0 obj
<>stream
endstream
endobj
163 0 obj
<>stream
endstream
endobj
164 0 obj
<>stream
endstream
endobj
165 0 obj
<>stream
endstream
endobj
166 0 obj
<>stream
endstream
endobj
167 0 obj
<>stream
endstream
endobj
168 0 obj
<>stream
BT
66.402 0 Td
(34)Tj
ET
Q
endstream
endobj
169 0 obj
<>/XObject<>>>/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 10 0 R/Annots 170 0 R/Contents 171 0 R/TrimBox[0 0 612 792]>>
endobj
170 0 obj
[172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R]
endobj
172 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref091)>>
endobj
173 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref093)>>
endobj
174 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref088)>>
endobj
175 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref090)>>
endobj
176 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref023)>>
endobj
177 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref094)>>
endobj
178 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref025)>>
endobj
179 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref001)>>
endobj
180 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.s002)>>
endobj
181 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.s003)>>
endobj
182 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref023)>>
endobj
183 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref022)>>
endobj
184 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref003)>>
endobj
185 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref027)>>
endobj
186 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref095)>>
endobj
187 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref096)>>
endobj
188 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref060)>>
endobj
189 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref066)>>
endobj
190 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref094)>>
endobj
191 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref097)>>
endobj
192 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref024)>>
endobj
193 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref044)>>
endobj
194 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref023)>>
endobj
195 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref003)>>
endobj
196 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref026)>>
endobj
197 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref095)>>
endobj
198 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref066)>>
endobj
199 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.s003)>>
endobj
171 0 obj
[200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R]
endobj
200 0 obj
<>stream
q
0.83 0.64 0.02 0 k
463.1811 667.3323 m
472.6488 667.3323 l
h
f*
477.8646 667.3323 m
487.3323 667.3323 l
h
f*
515.9055 667.3323 m
525.4299 667.3323 l
h
f*
438.0094 589.3228 m
447.5339 589.3228 l
h
f*
275.6409 563.3008 m
285.1654 563.3008 l
h
f*
278.4189 485.348 m
287.8866 485.348 l
h
f*
554.6268 420.3213 m
564.1512 420.3213 l
h
f*
327.4583 368.3339 m
332.2205 368.3339 l
h
f*
489.4866 355.3512 m
546.3496 355.3512 l
h
f*
330.5764 250.9228 m
387.3827 250.9228 l
h
f*
345.1465 224.9008 m
354.6709 224.9008 l
h
f*
475.3134 224.9008 m
484.8378 224.9008 l
h
f*
496.063 224.9008 m
500.8252 224.9008 l
h
f*
512.1071 224.9008 m
521.5748 224.9008 l
h
f*
532.8567 224.9008 m
542.3811 224.9008 l
h
f*
544.5921 224.9008 m
554.1165 224.9008 l
h
f*
331.8236 211.9181 m
341.348 211.9181 l
h
f*
508.7622 211.9181 m
518.2866 211.9181 l
h
f*
510.9732 198.9354 m
520.4976 198.9354 l
h
f*
531.7228 198.9354 m
541.2472 198.9354 l
h
f*
552.5291 198.9354 m
562.0535 198.9354 l
h
f*
445.7764 185.8961 m
455.3008 185.8961 l
h
f*
517.663 172.9134 m
527.1874 172.9134 l
h
f*
538.4126 172.9134 m
543.1748 172.9134 l
h
f*
554.4567 172.9134 m
563.9244 172.9134 l
h
f*
203.4142 159.9307 m
212.9386 159.9307 l
h
f*
224.1638 159.9307 m
233.6882 159.9307 l
h
f*
366.5764 94.9039 m
423.3827 94.9039 l
h
f*
0 g
1 j
1 J
0 w
10 0 0 10 200.0125 707.4141 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(and)Tj
1.7291 0 Td
(heuristics)Tj
4.0478 0 Td
(suitable)Tj
3.2825 0 Td
(to)Tj
1.0262 0 Td
(the)Tj
1.474 0 Td
(selection)Tj
3.7133 0 Td
(of)Tj
1.0148 0 Td
(appropriate)Tj
4.8813 0 Td
(concepts.)Tj
3.9458 0 Td
(Finally,)Tj
3.1691 0 Td
(the)Tj
1.474 0 Td
(last)Tj
1.559 0 Td
(recognized)Tj
4.5864 0 Td
(cri-)Tj
-35.9033 -1.3039 Td
(terion)Tj
2.6362 0 Td
(is)Tj
0.8447 0 Td
(the)Tj
1.474 0 Td
(exclusion)Tj
3.9855 0 Td
(of)Tj
1.0148 0 Td
(specific)Tj
3.1918 0 Td
(concepts)Tj
3.7247 0 Td
(related)Tj
2.9423 0 Td
(to)Tj
1.0261 0 Td
(particular)Tj
4.1102 0 Td
(fields,)Tj
2.5569 0 Td
(such)Tj
2.0636 0 Td
(as)Tj
1.0148 0 Td
(Oracle)Tj
2.863 0 Td
(Flashback)Tj
-33.4486 -1.2982 Td
(Transaction;)Tj
5.2497 0 Td
(Oracle)Tj
2.863 0 Td
(LogMiner;)Tj
4.4617 0 Td
(Oracle)Tj
2.8629 0 Td
(tools;)Tj
2.3641 0 Td
(SQLedit;)Tj
3.7247 0 Td
(MySQL)Tj
3.3279 0 Td
(utilities;)Tj
3.4015 0 Td
(and)Tj
1.7291 0 Td
(so)Tj
1.0885 0 Td
(on.)Tj
-29.8769 -1.2983 Td
(Therefore,)Tj
4.3936 0 Td
(in)Tj
1.0375 0 Td
(accordance)Tj
4.7338 0 Td
(with)Tj
2.0013 0 Td
(the)Tj
1.4683 0 Td
(findings)Tj
3.4923 0 Td
(of)Tj
1.0148 0 Td
(previous)Tj
3.651 0 Td
(studies)Tj
2.9877 0 Td
([)Tj
0.83 0.64 0.02 0 k
(91)Tj
0 g
()Tj
0.83 0.64 0.02 0 k
(93)Tj
0 g
(],)Tj
3.5433 0 Td
(and)Tj
1.7291 0 Td
([)Tj
0.83 0.64 0.02 0 k
(88)Tj
0 g
(],)Tj
2.0749 0 Td
(the)Tj
-33.3238 -1.2983 Td
(authors)Tj
3.2484 0 Td
(manually)Tj
3.9288 0 Td
(extracted)Tj
3.8835 0 Td
(concepts)Tj
3.7247 0 Td
(from)Tj
2.2053 0 Td
(each)Tj
2.0296 0 Td
(model)Tj
2.7439 0 Td
(\(containing)Tj
4.8699 0 Td
(18)Tj
1.1679 0 Td
(models)Tj
3.1067 0 Td
(in)Tj
1.0318 0 Td
(total\).)Tj
2.5739 0 Td
(This)Tj
1.9842 0 Td
(is)Tj
-36.4986 -1.3039 Td
(a)Tj
0.6519 0 Td
(laborious)Tj
3.9515 0 Td
(process)Tj
3.1804 0 Td
(whereby)Tj
3.6114 0 Td
(every)Tj
2.347 0 Td
(model)Tj
2.7439 0 Td
(is)Tj
0.8504 0 Td
(used)Tj
2.058 0 Td
(to)Tj
1.0261 0 Td
(identify)Tj
3.2938 0 Td
(potential)Tj
3.7644 0 Td
(concepts)Tj
3.7191 0 Td
(that)Tj
1.7801 0 Td
(are)Tj
-32.978 -1.2982 Td
(required)Tj
3.6396 0 Td
(in)Tj
1.0318 0 Td
(this)Tj
1.6781 0 Td
(study.)Tj
2.6135 0 Td
(The)Tj
1.7802 0 Td
(mechanism)Tj
4.8472 0 Td
(that)Tj
1.7801 0 Td
(was)Tj
1.6952 0 Td
(followed)Tj
3.651 0 Td
(to)Tj
1.0261 0 Td
(extract)Tj
2.931 0 Td
(concepts)Tj
3.7247 0 Td
(is)Tj
0.8504 0 Td
(as)Tj
1.0148 0 Td
(follows:)Tj
-32.2637 -1.2983 Td
(read)Tj
2.3697 0 Td
(a)Tj
0.652 0 Td
(main)Tj
2.2903 0 Td
(textual)Tj
2.914 0 Td
(model)Tj
2.744 0 Td
(word)Tj
2.3073 0 Td
(by)Tj
1.1849 0 Td
(word)Tj
2.3074 0 Td
(to)Tj
1.0261 0 Td
(first)Tj
1.8029 0 Td
(understand)Tj
4.7905 0 Td
(the)Tj
1.4683 0 Td
(purpose)Tj
3.4469 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4684 0 Td
(model)Tj
2.7439 0 Td
(and)Tj
-34.5314 -1.3039 Td
(then)Tj
2.0182 0 Td
(the)Tj
1.4683 0 Td
(meaning)Tj
3.7247 0 Td
(of)Tj
1.0148 0 Td
(each)Tj
2.0296 0 Td
(paragraph.)Tj
4.9096 0 Td
(Therefore,)Tj
4.3937 0 Td
(the)Tj
1.4683 0 Td
(concepts)Tj
3.7247 0 Td
(related)Tj
2.9424 0 Td
(to)Tj
1.0261 0 Td
(the)Tj
1.4683 0 Td
(Database)Tj
3.8495 0 Td
(Forensic)Tj
-34.0382 -1.2983 Td
(domain)Tj
3.3221 0 Td
(should)Tj
2.9197 0 Td
(be)Tj
1.1509 0 Td
(highlighted)Tj
4.7621 0 Td
(and)Tj
1.7292 0 Td
(extracted.)Tj
4.1102 0 Td
(According)Tj
4.439 0 Td
(to)Tj
1.0261 0 Td
([)Tj
0.83 0.64 0.02 0 k
(90)Tj
0 g
(],)Tj
2.075 0 Td
(It)Tj
1.2529 0 Td
(is)Tj
0.8447 0 Td
(important,)Tj
4.5071 0 Td
(to)Tj
1.0261 0 Td
(begin)Tj
2.4321 0 Td
(with)Tj
-35.5972 -1.2983 Td
(a)Tj
0.6519 0 Td
(very)Tj
1.9276 0 Td
(exhaustive)Tj
4.3993 0 Td
(list)Tj
1.3946 0 Td
(of)Tj
1.0148 0 Td
(concepts)Tj
3.7191 0 Td
(and)Tj
1.7348 0 Td
(gradually)Tj
3.9231 0 Td
(eliminate)Tj
3.9515 0 Td
(concepts)Tj
3.719 0 Td
(that)Tj
1.7801 0 Td
(are)Tj
1.4514 0 Td
(irrelevant.)Tj
-28.471 -1.3039 Td
(Wong's)Tj
3.2825 0 Td
(model)Tj
2.7439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(23)Tj
0 g
(])Tj
1.8482 0 Td
(covered)Tj
3.3505 0 Td
(the)Tj
1.4683 0 Td
(Oracle)Tj
2.863 0 Td
(database)Tj
3.6397 0 Td
(server)Tj
2.6248 0 Td
(forensic)Tj
3.4073 0 Td
(concepts)Tj
3.719 0 Td
(to)Tj
1.0261 0 Td
(reveal)Tj
2.5739 0 Td
(malicious)Tj
-33.7434 -1.2982 Td
(activities)Tj
3.7133 0 Td
(in)Tj
1.0375 0 Td
(a)Tj
0.652 0 Td
(database.)Tj
3.8664 0 Td
(However,)Tj
4.0762 0 Td
(it)Tj
0.7823 0 Td
(is)Tj
0.8504 0 Td
(limited)Tj
3.0671 0 Td
(in)Tj
1.0375 0 Td
(scope)Tj
2.4548 0 Td
(to)Tj
1.0261 0 Td
(the)Tj
1.4683 0 Td
(discovery)Tj
4.0082 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(SQL)Tj
1.9843 0 Td
(injection)Tj
-32.5075 -1.2983 Td
(attack.)Tj
2.8289 0 Td
(A)Tj
0.9014 0 Td
(total)Tj
2.0069 0 Td
(of)Tj
1.0148 0 Td
(17)Tj
1.1679 0 Td
(concepts)Tj
3.7247 0 Td
(have)Tj
2.0579 0 Td
(been)Tj
2.126 0 Td
(extracted,)Tj
4.1102 0 Td
(namely)Tj
/F10 1 Tf
3.1465 0 Td
[(\r)-2()12()12()7()12()20()]TJ
3.3845 0 Td
[()-5()-13()4( )4()2(\n)6()7()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.719 0 Td
[(#)39(\n)22()7()-9()4( )4()2()]TJ
3.5093 0 Td
[()6()-4()7()15()-13()14()-3()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
-33.698 -1.3039 Td
[()-6()22()11()22()4()-3()]TJ
3.8664 0 Td
[()-3()2()-20()3()2()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.7156 0 Td
[(\r)-2()10()4()4()7()-4()11()7( )]TJ
3.7303 0 Td
[( )4()22()11()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.211 0 Td
[()-6()22()11()22()4()-3()]TJ
3.8665 0 Td
[()7()11(\n)22()11()2(\n)22()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.6566 0 Td
[()2()7()7()11(\n)9()7()-9()4()-4()7()12(\n)13()]TJ
5.9641 0 Td
[( )4()22()11()22()4()-3()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.8948 0 Td
[()2()7( )4()]TJ
2.1656 0 Td
[()4()2()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
1.5591 0 Td
[(0)38(\n)6( )4()]TJ
2.4037 0 Td
[()4()2()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
-36.0337 -1.2983 Td
[(")30()4( )12()14()]TJ
2.4604 0 Td
[()7()20()16()4()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.092 0 Td
[(")20()4()2()-19()]TJ
2.1599 0 Td
[()4()2()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
1.5648 0 Td
[(1)31()12()18()12(\n)13()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.7077 0 Td
[()-16($)-4()16()18()12(\n)6()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.5615 0 Td
[(%)-2()6()13(*)18()10()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.3449 0 Td
[( )75()20()16(\n)-3()6()-4()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.1533 0 Td
[(#)39(\n)24()3()8()9()7()10()2()22()7()4()11(\n)]TJ
5.2554 0 Td
[( )97()7()16()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
-31.2999 -1.2982 Td
[()2()8()-3()11()12()20()7()8()]TJ
/F5 1 Tf
(,)Tj
4.2009 0 Td
(and)Tj
1.7348 0 Td
(finally,)Tj
/F10 1 Tf
2.9253 0 Td
[()-6()16()6()15()2()]TJ
3.4753 0 Td
[()-6()22()11()22()4()-3()]TJ
/F5 1 Tf
(.)Tj
-11.1401 -1.2983 Td
(Fowler's)Tj
3.5603 0 Td
(model)Tj
2.7439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(94)Tj
0 g
(])Tj
1.8482 0 Td
(covered)Tj
3.3505 0 Td
(MSSQL)Tj
3.3505 0 Td
(Server)Tj
2.7383 0 Td
(forensic)Tj
3.4129 0 Td
(concepts)Tj
3.719 0 Td
(which)Tj
2.6532 0 Td
(were)Tj
2.1203 0 Td
(used)Tj
2.0636 0 Td
(during)Tj
2.9253 0 Td
(the)Tj
-35.6822 -1.3039 Td
(investigation)Tj
5.3574 0 Td
(process.)Tj
3.4129 0 Td
(A)Tj
0.9014 0 Td
(total)Tj
2.0069 0 Td
(of)Tj
1.0148 0 Td
(17)Tj
1.1679 0 Td
(concepts)Tj
3.7247 0 Td
(were)Tj
2.1203 0 Td
(extracted)Tj
3.8891 0 Td
(from)Tj
2.2053 0 Td
(Flower's)Tj
3.5547 0 Td
(model,)Tj
2.9706 0 Td
(and)Tj
1.7292 0 Td
(these)Tj
-34.0552 -1.2983 Td
(included)Tj
/F10 1 Tf
3.7133 0 Td
[()-6()22()11()]TJ
2.1827 0 Td
[()6()7()14()12()-4()10()14()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.7281 0 Td
[()-6()22()11()22()4()-3()]TJ
3.8665 0 Td
[()-3()2()-20()3()2()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.7155 0 Td
[(\r)-2()12()12()7()12()20()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.6114 0 Td
[(")30()7()14()12()12()20()7( )]TJ
3.7643 0 Td
[( )4()22()11()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.2111 0 Td
[( )75()20()16(\n)-3()6()-4()7()4()11(\n)]TJ
4.9322 0 Td
[()4()2()-3()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
1.8879 0 Td
[()34()-13()4( )4()2(\n)6()7()]TJ
-33.613 -1.2983 Td
[()12(\n)22()11()9()-8()-9()14()-3()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.702 0 Td
[()13()-4()10()11()4()1()4()11()-4()]TJ
4.2349 0 Td
[()7()20()16(\n)-3()6()-4()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.8642 0 Td
[()34()-13()4( )4()2(\n)6()7()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.8778 0 Td
[()92()10()4()22()7()4()4()]TJ
3.2598 0 Td
[( )4()22()11()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.2167 0 Td
[(/)28()11(\n)3()10()4()22()7()4()4()]TJ
5.0513 0 Td
[( )4()22()11()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.211 0 Td
[()34()3()2(\n)22()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.6476 0 Td
[(')-4()14()2()11()14()]TJ
3.0387 0 Td
[()-8()4()4()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
-35.104 -1.3039 Td
[(2)-3()2()]TJ
1.627 0 Td
[()-8()4()4()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
1.6044 0 Td
[()-6()22()11()22()4()-3()]TJ
3.8721 0 Td
[()-8()4()4()8()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
1.9332 0 Td
[(#)39(\n)6()1()4( )4()2(\n)22()]TJ
3.4299 0 Td
[()20()8()10()4()11(\n)-3()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.7191 0 Td
[( )75()-9()-4()9()11()7( )]TJ
3.2144 0 Td
[()9()11()20()2(\n)10()4()]TJ
3.2032 0 Td
[(3)3()11()8(*)9()11()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.074 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[( )53()12()6()15()12()12(\n)6()]TJ
/F5 1 Tf
(.)Tj
-28.2102 -1.2982 Td
(Additionally,)Tj
5.4595 0 Td
(some)Tj
2.33 0 Td
(16)Tj
1.1679 0 Td
(further)Tj
3.0274 0 Td
(concepts)Tj
3.7247 0 Td
(have)Tj
2.0579 0 Td
(been)Tj
2.126 0 Td
(identified)Tj
4.0592 0 Td
(from)Tj
2.2053 0 Td
(Leitchfield's)Tj
5.023 0 Td
(model)Tj
2.7439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(25)Tj
0 g
(],)Tj
-35.121 -1.2983 Td
(including)Tj
/F10 1 Tf
4.0421 0 Td
[()2()7( )4()]TJ
2.16 0 Td
[()4()2()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
1.5647 0 Td
[(4)-4()22()10()6()2()-9()12(\n)13()]TJ
4.1443 0 Td
[()-5()-13()4( )4()2(\n)6()7()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.719 0 Td
[(1)31()12()18()12(\n)13()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.7134 0 Td
[()-16($)-4()16()18()12(\n)6()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.5615 0 Td
[(&)31()11()20()2(\n)10()4()]TJ
3.4526 0 Td
[()1($)-4()16()18()12(\n)6()2()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.1102 0 Td
[()13()-4()10()11()4()1()4()11()-4()]TJ
-32.4678 -1.3039 Td
[()6()-4()7()15()-13()14()-3()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.2995 0 Td
[()92()10()4()22()7()4()4()]TJ
3.2654 0 Td
[()-5()-13()4( )4()2(\n)6()7()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.7191 0 Td
[(/)28()11(\n)3()10()4()22()7()4()4()]TJ
5.0513 0 Td
[()-5()-13()4( )4()2(\n)6()7()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.719 0 Td
[(#)39(\n)6()1()4( )4()2(\n)22()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.6567 0 Td
[()-6()22()11()22()4()-3()]TJ
3.8664 0 Td
[()-6()2()-20()3()2()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.8403 0 Td
[(')-4()14()2()11()14()]TJ
3.0444 0 Td
[()-8()4()4()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
1.6044 0 Td
[(')-4()6()2()16(\n)18()]TJ
-34.0665 -1.2983 Td
[(5)-3()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.9026 0 Td
[(\r)-2()11()12()-19()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.7156 0 Td
[(2)22()15()3()]TJ
1.8425 0 Td
[()20()8()10()4()11(\n)-3()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.719 0 Td
[(\r)-2()10()4()4()7()-4()7()4()11(\n)]TJ
4.0989 0 Td
[()-3()2()-20()3()2()]TJ
/F5 1 Tf
(,)Tj
2.7156 0 Td
(and)Tj
/F10 1 Tf
1.7291 0 Td
[()-6()7()1()-4()10()4()11(\n)]TJ
/F5 1 Tf
(.)Tj
3.7644 0 Td
(Furthermore,)Tj
5.6125 0 Td
(10)Tj
1.1736 0 Td
(concepts)Tj
3.719 0 Td
(were)Tj
-33.9928 -1.2983 Td
(extracted)Tj
3.8834 0 Td
(from)Tj
2.2053 0 Td
(Olivier's)Tj
3.5717 0 Td
(model)Tj
2.7439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(1)Tj
0 g
(]:)Tj
/F10 1 Tf
1.6044 0 Td
[()-6()22()11()22()4()-3()]TJ
3.8664 0 Td
[()7()11(\n)22()11()2(\n)22()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.6567 0 Td
[()-16($)-4()16()18()12(\n)6()22()7()4()11(\n)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
5.5615 0 Td
[(%)-2()6()13(*)18()10()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.3449 0 Td
[(#)39(\n)24()3()8()9()7()10()2()22()7()4()11(\n)]TJ
-30.4382 -1.2982 Td
[( )97()7()16()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
2.6928 0 Td
[()-6()11()12()20()7()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.0161 0 Td
[()34()-13()4( )4()2(\n)6()7()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.8721 0 Td
[(#)39(\n)6()1()4( )4()2(\n)22()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.6567 0 Td
[()13(%!)]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
3.0387 0 Td
[(\r)-2()11()12()-19()]TJ
/F5 1 Tf
(,)Tj
2.7156 0 Td
(and)Tj
/F10 1 Tf
1.7347 0 Td
[(\r)-2()12()12()7()12()20()]TJ
/F5 1 Tf
(.)Tj
3.6057 0 Td
(\(Table)Tj
2.7836 0 Td
(B)Tj
0.7994 0 Td
(in)Tj
0.83 0.64 0.02 0 k
1.0318 0 Td
(S2)Tj
1.1735 0 Td
(Appendix)Tj
4.1726 0 Td
(I)Tj
0 g
(\))Tj
0.9014 0 Td
(dis-)Tj
-35.1947 -1.3039 Td
(plays)Tj
2.2336 0 Td
(the)Tj
1.4684 0 Td
(extracted)Tj
3.8834 0 Td
(concepts.)Tj
3.9515 0 Td
(Hence,)Tj
3.0274 0 Td
(the)Tj
1.474 0 Td
(output)Tj
2.897 0 Td
(of)Tj
1.0148 0 Td
(this)Tj
1.6724 0 Td
(step)Tj
1.8198 0 Td
(is)Tj
0.8504 0 Td
(246)Tj
1.6441 0 Td
(general)Tj
3.1351 0 Td
(concepts.)Tj
ET
Q
q
1 j
1 J
0 w
11.9999 0 0 11.9999 200.0125 308.0125 cm
BT
/F0 1 Tf
1 TL
-0.0033 Tc
0 0 Td
(3.3)Tj
1.5921 0 Td
(Nominate)Tj
4.4504 0 Td
(and)Tj
1.8662 0 Td
(propose)Tj
3.7843 0 Td
(common)Tj
4.0205 0 Td
(concepts)Tj
ET
Q
q
1 j
1 J
0 w
10 0 0 10 200.0125 291.0047 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(In)Tj
1.1055 0 Td
(this)Tj
1.6781 0 Td
(step,)Tj
2.0409 0 Td
(we)Tj
1.3323 0 Td
(nominate)Tj
4.0648 0 Td
(common)Tj
3.8438 0 Td
(concepts)Tj
3.7247 0 Td
(from)Tj
2.2053 0 Td
(among)Tj
2.9934 0 Td
(246)Tj
1.6497 0 Td
(extracted)Tj
3.8835 0 Td
(concepts)Tj
3.7247 0 Td
(based)Tj
2.4718 0 Td
(on)Tj
-34.7185 -1.2982 Td
(similarity)Tj
4.0024 0 Td
(in)Tj
1.0375 0 Td
(meaning)Tj
3.7304 0 Td
(or)Tj
1.0942 0 Td
(function.)Tj
3.855 0 Td
(Thus,)Tj
2.4718 0 Td
(authors)Tj
3.2485 0 Td
(nominate)Tj
4.0649 0 Td
(the)Tj
1.474 0 Td
(concepts)Tj
3.719 0 Td
(in)Tj
1.0375 0 Td
(clusters.)Tj
3.4582 0 Td
(Each)Tj
2.1714 0 Td
(clus-)Tj
-35.3648 -1.3039 Td
(ter)Tj
1.3095 0 Td
(has)Tj
1.5478 0 Td
(similar)Tj
2.982 0 Td
(concepts)Tj
3.7247 0 Td
(in)Tj
1.0375 0 Td
(meaning)Tj
3.7247 0 Td
(and)Tj
1.7291 0 Td
(function.)Tj
3.8551 0 Td
(The)Tj
1.7801 0 Td
(outcome)Tj
3.7304 0 Td
(of)Tj
1.0148 0 Td
(this)Tj
1.6724 0 Td
(process)Tj
3.1861 0 Td
(resulted)Tj
3.3959 0 Td
(in)Tj
1.0375 0 Td
(44)Tj
-35.7276 -1.2983 Td
(clusters,)Tj
3.4582 0 Td
(as)Tj
1.0148 0 Td
(shown)Tj
2.846 0 Td
(in)Tj
1.0374 0 Td
(\(Table)Tj
2.7836 0 Td
(C)Tj
0.8788 0 Td
(in)Tj
0.83 0.64 0.02 0 k
1.0374 0 Td
(S3)Tj
1.1736 0 Td
(Appendix)Tj
4.1669 0 Td
(I)Tj
0 g
(\).)Tj
-17.2005 -1.2983 Td
(For)Tj
1.627 0 Td
(example,)Tj
3.7758 0 Td
(the)Tj
1.4683 0 Td
(following)Tj
3.9798 0 Td
(are)Tj
1.4513 0 Td
(concepts)Tj
3.7191 0 Td
(that)Tj
1.7801 0 Td
(are)Tj
1.4514 0 Td
(clustered)Tj
3.821 0 Td
(based)Tj
2.4718 0 Td
(on)Tj
1.2756 0 Td
(similar)Tj
2.9877 0 Td
(meaning:)Tj
-31.0051 -1.3039 Td
()Tj
/F10 1 Tf
[()2()7()7()11(\n)9()7()-9()4()-4()7()12(\n)13()]TJ
6.3495 0 Td
[( )4()22()11()22()4()-3()57(+)]TJ
/F5 1 Tf
4.0422 0 Td
(in)Tj
1.0375 0 Td
(model)Tj
2.7439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(23)Tj
0 g
(];)Tj
2.0749 0 Td
()Tj
/F10 1 Tf
[()2()7()7()11(\n)9()7()-9()4()-4()7()4()11(\n)]TJ
/F5 1 Tf
()Tj
6.7975 0 Td
(in)Tj
1.0374 0 Td
(models)Tj
3.1068 0 Td
([)Tj
0.83 0.64 0.02 0 k
(22)Tj
0 g
(],)Tj
2.0749 0 Td
([)Tj
0.83 0.64 0.02 0 k
(3)Tj
0 g
(],)Tj
1.6044 0 Td
([)Tj
0.83 0.64 0.02 0 k
(27)Tj
0 g
(],)Tj
2.075 0 Td
([)Tj
0.83 0.64 0.02 0 k
(95)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(96)Tj
0 g
(];)Tj
-32.944 -1.2982 Td
()Tj
/F10 1 Tf
[()2()7()7()11(\n)9()7()-9()4()-4()7()4()11(\n)]TJ
6.4062 0 Td
[()-5()3()2(\n)22()]TJ
/F5 1 Tf
()Tj
2.6532 0 Td
(in)Tj
1.0375 0 Td
(model)Tj
2.7439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(60)Tj
0 g
(];)Tj
2.075 0 Td
(and)Tj
1.7291 0 Td
()Tj
/F10 1 Tf
[()2()7()7()11(\n)9()7()-9()4()-4()7()12(\n)13()]TJ
/F5 1 Tf
()Tj
6.7464 0 Td
(concept)Tj
3.3619 0 Td
(in)Tj
1.0374 0 Td
(model)Tj
2.744 0 Td
([)Tj
0.83 0.64 0.02 0 k
(66)Tj
0 g
(].)Tj
2.0749 0 Td
(To)Tj
1.338 0 Td
(provide)Tj
-33.9475 -1.2983 Td
(another)Tj
3.3278 0 Td
(example,)Tj
3.7757 0 Td
(the)Tj
1.4684 0 Td
()Tj
/F10 1 Tf
[(\r)-2()12()12()7()12()20()]TJ
/F5 1 Tf
()Tj
4.1669 0 Td
(concept)Tj
3.3618 0 Td
(has)Tj
1.5421 0 Td
(been)Tj
2.1259 0 Td
(mentioned)Tj
4.5808 0 Td
(in)Tj
1.0375 0 Td
(three)Tj
2.262 0 Td
(models)Tj
3.1068 0 Td
([)Tj
0.83 0.64 0.02 0 k
(94)Tj
0 g
(],)Tj
2.0749 0 Td
([)Tj
0.83 0.64 0.02 0 k
(97)Tj
0 g
(],)Tj
2.0806 0 Td
([)Tj
0.83 0.64 0.02 0 k
(24)Tj
0 g
(],)Tj
-34.9112 -1.3039 Td
(together)Tj
3.5319 0 Td
(with)Tj
2.0012 0 Td
(its)Tj
1.1452 0 Td
(synonym)Tj
3.9118 0 Td
()Tj
/F10 1 Tf
[()-6()2(5)12()20()]TJ
/F5 1 Tf
()Tj
3.8154 0 Td
(mentioned)Tj
4.5808 0 Td
(in)Tj
1.0375 0 Td
(the)Tj
1.4683 0 Td
(model)Tj
2.7439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(44)Tj
0 g
(].)Tj
2.0806 0 Td
(These)Tj
2.5625 0 Td
(have)Tj
2.0636 0 Td
(all)Tj
1.1452 0 Td
(been)Tj
2.1203 0 Td
(grouped)Tj
-34.2082 -1.2983 Td
(in)Tj
1.0318 0 Td
(a)Tj
0.6576 0 Td
(cluster.)Tj
3.0954 0 Td
(Additionally,)Tj
5.4538 0 Td
(the)Tj
1.4684 0 Td
()Tj
/F10 1 Tf
[( )75()20()16(\n)-3()6()-4()7()4()11(\n)]TJ
/F5 1 Tf
()Tj
5.7146 0 Td
(concept)Tj
3.3618 0 Td
(mentioned)Tj
4.5865 0 Td
(in)Tj
1.0374 0 Td
(four)Tj
1.9106 0 Td
(models)Tj
3.1067 0 Td
([)Tj
0.83 0.64 0.02 0 k
(23)Tj
0 g
(],)Tj
2.075 0 Td
([)Tj
0.83 0.64 0.02 0 k
(3)Tj
0 g
(],)Tj
1.6044 0 Td
([)Tj
0.83 0.64 0.02 0 k
(26)Tj
0 g
(],)Tj
-35.104 -1.2983 Td
([)Tj
0.83 0.64 0.02 0 k
(95)Tj
0 g
(],)Tj
2.0749 0 Td
([)Tj
0.83 0.64 0.02 0 k
(66)Tj
0 g
(])Tj
1.8538 0 Td
(has)Tj
1.5421 0 Td
(been)Tj
2.1203 0 Td
(grouped)Tj
3.5603 0 Td
(into)Tj
1.8425 0 Td
(one)Tj
1.6951 0 Td
(cluster.)Tj
3.1011 0 Td
(Therefore,)Tj
4.3936 0 Td
(the)Tj
1.4684 0 Td
(concepts)Tj
3.719 0 Td
(that)Tj
1.7802 0 Td
(have)Tj
2.0579 0 Td
(a)Tj
0.6576 0 Td
(similar)Tj
2.9877 0 Td
(mean-)Tj
-34.8545 -1.2982 Td
(ing)Tj
1.5023 0 Td
(or)Tj
1.0942 0 Td
(function)Tj
3.6283 0 Td
(have)Tj
2.0636 0 Td
(been)Tj
2.1203 0 Td
(grouped)Tj
3.5603 0 Td
(together)Tj
3.5319 0 Td
(in)Tj
1.0375 0 Td
(clusters.)Tj
-17.3422 -1.3039 Td
(Additionally,)Tj
5.4595 0 Td
(to)Tj
1.0204 0 Td
(propose)Tj
3.4243 0 Td
(a)Tj
0.6576 0 Td
(common)Tj
3.8437 0 Td
(concept)Tj
3.3619 0 Td
(for)Tj
1.3833 0 Td
(each)Tj
2.0296 0 Td
(cluster,)Tj
3.1011 0 Td
(we)Tj
1.3266 0 Td
(used)Tj
2.0579 0 Td
(the)Tj
1.4684 0 Td
(following)Tj
3.9798 0 Td
(three)Tj
-34.3103 -1.2983 Td
(features)Tj
3.3448 0 Td
(to)Tj
1.0261 0 Td
(distinguish)Tj
4.6375 0 Td
(amongst)Tj
3.6567 0 Td
(cluster)Tj
2.8686 0 Td
(concepts:)Tj
/F10 1 Tf
3.9515 0 Td
[(&)25()20()7()14()4()2(\n)6()-9()]TJ
/F5 1 Tf
(,)Tj
/F10 1 Tf
4.4447 0 Td
[(4)-4()2(\n)6()2()20()11()12()14()-3()]TJ
/F5 1 Tf
(,)Tj
4.5127 0 Td
(and)Tj
/F10 1 Tf
1.7291 0 Td
[()-6()1()-8()12(\n)18()14()7()4()11(\n)]TJ
/F5 1 Tf
(.)Tj
4.4164 0 Td
(Thus,)Tj
2.4774 0 Td
(a)Tj
-37.0655 -1.2983 Td
(concept)Tj
3.3618 0 Td
(that)Tj
1.7745 0 Td
(has)Tj
1.5477 0 Td
(high)Tj
2.0069 0 Td
(frequency,)Tj
4.4107 0 Td
(generic)Tj
3.1408 0 Td
(meaning)Tj
3.7303 0 Td
(and)Tj
1.7292 0 Td
(definition)Tj
4.1612 0 Td
(may)Tj
1.9275 0 Td
(be)Tj
1.1509 0 Td
(proposed)Tj
3.9515 0 Td
(as)Tj
1.0148 0 Td
(a)Tj
0.6576 0 Td
(com-)Tj
-34.5654 -1.3039 Td
(mon)Tj
2.0919 0 Td
(concept,)Tj
3.5886 0 Td
(as)Tj
1.0148 0 Td
(illustrated)Tj
4.2236 0 Td
(in)Tj
1.0318 0 Td
(\(Table)Tj
2.7836 0 Td
(C)Tj
0.8844 0 Td
(in)Tj
0.83 0.64 0.02 0 k
1.0375 0 Td
(S3)Tj
1.1679 0 Td
(Appendix)Tj
4.1726 0 Td
(I)Tj
0 g
(\).)Tj
1.1225 0 Td
(For)Tj
1.6271 0 Td
(example,)Tj
/F10 1 Tf
3.7757 0 Td
[(6)30(\r)-2()12()12()7()12()20()57(+)]TJ
/F5 1 Tf
4.1385 0 Td
(has)Tj
1.5421 0 Td
(been)Tj
-34.2026 -1.2982 Td
(proposed)Tj
3.9514 0 Td
(as)Tj
1.0148 0 Td
(a)Tj
0.652 0 Td
(common)Tj
3.8437 0 Td
(concept)Tj
3.3619 0 Td
(in)Tj
1.0375 0 Td
(Cluster)Tj
3.1124 0 Td
(1)Tj
0.6973 0 Td
(due)Tj
1.6951 0 Td
(to)Tj
1.0262 0 Td
(its)Tj
1.1452 0 Td
(having)Tj
2.9196 0 Td
(higher)Tj
2.8006 0 Td
(frequency)Tj
4.1896 0 Td
(and)Tj
1.7291 0 Td
(definition,)Tj
ET
Q
q
1 j
1 J
0 w
576 737.1 m
36 737.1 l
36 737.6 l
576 737.6 l
f*
36 741.2598 107.1496 23.6976 re
W* n
q
107.0929 0 0 23.6409 36 741.3165 cm
q
/I0 Do
Q
Q
Q
q
0 0 612 792 re
W* n
1 j
1 J
0 w
7.9999 0 0 7.9999 328.0251 745.7952 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(Developme)Tj
4.9677 0 Td
(nt)Tj
1.0417 0 Td
(and)Tj
1.8568 0 Td
(validation)Tj
4.3583 0 Td
(of)Tj
1.0417 0 Td
(a)Tj
0.7654 0 Td
(Databas)Tj
3.6567 0 Td
(e)Tj
0.7653 0 Td
(Forensic)Tj
3.9898 0 Td
(Metamodel)Tj
5.0883 0 Td
(\(DBFM\))Tj
ET
Q
q
1 j
1 J
0 w
36 48.0002 m
576 48.0002 l
576 47.5002 l
36 47.5002 l
f*
7.9999 0 0 7.9999 36 36 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(PLOS)Tj
2.8559 0 Td
(ONE)Tj
2.3669 0 Td
(|)Tj
0.4748 0 Td
(DOI:10.137)Tj
5.0387 0 Td
(1/journal.po)Tj
5.1236 0 Td
(ne.0170)Tj
3.5434 0 Td
(793)Tj
2.6362 0 Td
(February)Tj
4.1599 0 Td
(1,)Tj
1.0417 0 Td
(2017)Tj
37.8995 0 Td
(7)Tj
0.7654 0 Td
(/)Tj
ET
endstream
endobj
201 0 obj
<>stream
endstream
endobj
202 0 obj
<>stream
endstream
endobj
203 0 obj
<>stream
endstream
endobj
204 0 obj
<>stream
endstream
endobj
205 0 obj
<>stream
endstream
endobj
206 0 obj
<>stream
endstream
endobj
207 0 obj
<>stream
endstream
endobj
208 0 obj
<>stream
endstream
endobj
209 0 obj
<>stream
endstream
endobj
210 0 obj
<>stream
endstream
endobj
211 0 obj
<>stream
endstream
endobj
212 0 obj
<>stream
endstream
endobj
213 0 obj
<>stream
endstream
endobj
214 0 obj
<>stream
endstream
endobj
215 0 obj
<>stream
endstream
endobj
216 0 obj
<>stream
endstream
endobj
217 0 obj
<>stream
endstream
endobj
218 0 obj
<>stream
endstream
endobj
219 0 obj
<>stream
endstream
endobj
220 0 obj
<>stream
endstream
endobj
221 0 obj
<>stream
endstream
endobj
222 0 obj
<>stream
BT
66.402 0 Td
(34)Tj
ET
Q
endstream
endobj
223 0 obj
<>/XObject<>>>/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 10 0 R/Annots 224 0 R/Contents 225 0 R/TrimBox[0 0 612 792]>>
endobj
224 0 obj
[226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R]
endobj
226 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.s003)>>
endobj
227 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref087)>>
endobj
228 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref088)>>
endobj
229 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref098)>>
endobj
230 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref096)>>
endobj
231 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref099)>>
endobj
232 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref094)>>
endobj
233 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref003)>>
endobj
234 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref095)>>
endobj
235 0 obj
<>/Border[0 0 0]/Dest(Rpone.0170793.ref096)>>
endobj
225 0 obj
[236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R]
endobj
236 0 obj
<>stream
q
0.83 0.64 0.02 0 k
200.0126 680.315 m
256.8189 680.315 l
h
f*
515.8488 584.6173 m
525.3732 584.6173 l
h
f*
527.5843 584.6173 m
537.1087 584.6173 l
h
f*
548.3906 584.6173 m
557.8583 584.6173 l
h
f*
519.2504 571.6346 m
528.7748 571.6346 l
h
f*
337.0961 237.9402 m
346.6205 237.9402 l
h
f*
266.0598 133.9087 m
275.5843 133.9087 l
h
f*
556.4976 133.9087 m
561.2031 133.9087 l
h
f*
347.4142 107.9433 m
356.8819 107.9433 l
h
f*
350.3055 94.9039 m
359.8299 94.9039 l
h
f*
0 g
1 j
1 J
0 w
10 0 0 10 200.0125 707.4141 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(as)Tj
1.0147 0 Td
(well)Tj
1.8199 0 Td
(as)Tj
1.0148 0 Td
(covering)Tj
3.6793 0 Td
(the)Tj
1.4684 0 Td
(entire)Tj
2.5568 0 Td
(DBF)Tj
2.0636 0 Td
(domain.)Tj
3.549 0 Td
(Additionally,)Tj
/F10 1 Tf
5.4538 0 Td
[(6)14()-6()22()11(")30()7()14()12()-4()10()14()7()4()11(\n)91(+)]TJ
/F5 1 Tf
7.387 0 Td
(has)Tj
1.5421 0 Td
(been)Tj
2.1203 0 Td
(proposed)Tj
-33.6697 -1.3039 Td
(as)Tj
1.0147 0 Td
(a)Tj
0.652 0 Td
(common)Tj
3.8438 0 Td
(concept)Tj
3.3618 0 Td
(in)Tj
1.0375 0 Td
(Cluster)Tj
3.1124 0 Td
(2,)Tj
0.9184 0 Td
(along)Tj
2.4208 0 Td
(with)Tj
/F10 1 Tf
2.0013 0 Td
[(6)14(#)39(\n)24()3()8()9()7()10()2()22()7()4()11(\n)70( )97()7()16()91(+)]TJ
/F5 1 Tf
8.2544 0 Td
(in)Tj
1.0375 0 Td
(Cluster)Tj
3.1067 0 Td
(13.)Tj
1.4003 0 Td
(\(Table)Tj
2.778 0 Td
(C)Tj
0.8844 0 Td
(in)Tj
0.83 0.64 0.02 0 k
-35.824 -1.2982 Td
(S3)Tj
1.1678 0 Td
(Appendix)Tj
4.1726 0 Td
(I)Tj
0 g
(\))Tj
0.9014 0 Td
(displays)Tj
3.3902 0 Td
(the)Tj
1.4684 0 Td
(proposed)Tj
3.9514 0 Td
(common)Tj
3.8438 0 Td
(concepts.)Tj
ET
Q
q
1 j
1 J
0 w
11.9999 0 0 11.9999 200.0125 654.6897 cm
BT
/F0 1 Tf
1 TL
-0.0033 Tc
0 0 Td
(3.4)Tj
1.5921 0 Td
(Short-listing)Tj
5.4331 0 Td
(of)Tj
1.0441 0 Td
(candidate)Tj
4.5024 0 Td
(definitions)Tj
ET
Q
q
1 j
1 J
0 w
10 0 0 10 200.0125 637.6818 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(For)Tj
1.627 0 Td
(every)Tj
2.3471 0 Td
(concept,)Tj
3.583 0 Td
(we)Tj
1.3322 0 Td
(short-list)Tj
3.8041 0 Td
(several)Tj
2.9367 0 Td
(definitions)Tj
4.5241 0 Td
(to)Tj
1.0261 0 Td
(use)Tj
1.5307 0 Td
(towards)Tj
3.4015 0 Td
(deriving)Tj
3.549 0 Td
(a)Tj
0.652 0 Td
(common)Tj
3.8437 0 Td
(defini-)Tj
-34.1572 -1.2982 Td
(tion.)Tj
2.0636 0 Td
(When)Tj
2.6872 0 Td
(two)Tj
1.7064 0 Td
(or)Tj
1.0999 0 Td
(more)Tj
2.3414 0 Td
(concepts)Tj
3.7247 0 Td
(share)Tj
2.3357 0 Td
(the)Tj
1.4683 0 Td
(same)Tj
2.2621 0 Td
(definition,)Tj
4.388 0 Td
(a)Tj
0.6519 0 Td
(process)Tj
3.1862 0 Td
(to)Tj
1.0261 0 Td
(reconcile)Tj
3.8494 0 Td
(and)Tj
1.7348 0 Td
(fit)Tj
1.0715 0 Td
(the)Tj
-35.5972 -1.2983 Td
(definition)Tj
4.1612 0 Td
(is)Tj
0.8504 0 Td
(required.)Tj
3.8607 0 Td
(A)Tj
0.9071 0 Td
(greater)Tj
3.0047 0 Td
(weight)Tj
2.8857 0 Td
(is)Tj
0.8504 0 Td
(given)Tj
2.381 0 Td
(to)Tj
1.0205 0 Td
(sources)Tj
3.1975 0 Td
(with)Tj
1.9956 0 Td
(clearer)Tj
2.9139 0 Td
(definitions)Tj
4.5241 0 Td
(\(as)Tj
1.355 0 Td
(opposed)Tj
-33.9078 -1.3039 Td
(to)Tj
1.0261 0 Td
(those)Tj
2.3357 0 Td
(considered)Tj
4.5978 0 Td
(implicit)Tj
3.3278 0 Td
(definitions)Tj
4.5241 0 Td
(that)Tj
1.7802 0 Td
(can)Tj
1.627 0 Td
(be)Tj
1.1509 0 Td
(subject)Tj
3.016 0 Td
(to)Tj
1.0262 0 Td
(interpretation\).)Tj
6.3609 0 Td
(However,)Tj
4.0762 0 Td
(the)Tj
-34.8489 -1.2983 Td
(concepts)Tj
3.719 0 Td
(that)Tj
1.7801 0 Td
(have)Tj
2.058 0 Td
(multiple)Tj
3.5659 0 Td
(definitions)Tj
4.5241 0 Td
(comply)Tj
3.1918 0 Td
(with)Tj
1.9956 0 Td
(the)Tj
1.4683 0 Td
(reconciliation)Tj
5.7543 0 Td
(process)Tj
3.1861 0 Td
([)Tj
0.83 0.64 0.02 0 k
(87)Tj
0 g
(,)Tj
0.83 0.64 0.02 0 k
(88)Tj
0 g
(],)Tj
3.2542 0 Td
([)Tj
0.83 0.64 0.02 0 k
(98)Tj
0 g
(].)Tj
-34.4974 -1.2982 Td
(For)Tj
1.627 0 Td
(example,)Tj
3.7701 0 Td
(from)Tj
2.211 0 Td
(the)Tj
1.4683 0 Td
(Ideal)Tj
2.1884 0 Td
(Log)Tj
1.7291 0 Td
(Setting)Tj
2.999 0 Td
(for)Tj
1.389 0 Td
(Database)Tj
3.8437 0 Td
(Forensics)Tj
4.0139 0 Td
(Reconstruction)Tj
6.3439 0 Td
([)Tj
0.83 0.64 0.02 0 k
(96)Tj
0 g
(],)Tj
2.0806 0 Td
(we)Tj
1.3266 0 Td
(short-)Tj
-34.9906 -1.3039 Td
(list)Tj
1.3889 0 Td
(only)Tj
1.9786 0 Td
(the)Tj
1.4683 0 Td
(following)Tj
3.9798 0 Td
(concept)Tj
3.3619 0 Td
(definitions:)Tj
-12.1775 -1.8992 Td
()Tj
/F11 1 Tf
0.7823 0 Td
(Reconstruction)Tj
/F5 1 Tf
(:)Tj
6.8315 0 Td
(`its)Tj
1.3719 0 Td
(application)Tj
4.6772 0 Td
(in)Tj
1.0374 0 Td
(database)Tj
3.6397 0 Td
(forensics)Tj
3.77 0 Td
(also)Tj
1.7689 0 Td
(involves)Tj
3.4809 0 Td
(the)Tj
1.474 0 Td
(reconstruction)Tj
6.0944 0 Td
(of)Tj
-34.1459 -1.2983 Td
(data)Tj
1.9105 0 Td
(that)Tj
1.7802 0 Td
(might)Tj
2.5965 0 Td
(have)Tj
2.0636 0 Td
(existed)Tj
2.982 0 Td
(on)Tj
1.2756 0 Td
(a)Tj
0.6577 0 Td
(database)Tj
3.6396 0 Td
(at)Tj
0.9525 0 Td
(an)Tj
1.2018 0 Td
(earlier)Tj
2.7553 0 Td
(time)Tj
2.0296 0 Td
(prior)Tj
2.2507 0 Td
(to)Tj
1.0261 0 Td
(some)Tj
2.3301 0 Td
(modifications)Tj
5.7373 0 Td
(or)Tj
-35.1891 -1.2983 Td
(deletion'.)Tj
-0.7823 -1.8992 Td
()Tj
/F11 1 Tf
0.7823 0 Td
(Transaction)Tj
5.2611 0 Td
(logs)Tj
/F5 1 Tf
(:)Tj
2.1089 0 Td
(`transaction)Tj
4.938 0 Td
(logs)Tj
1.7971 0 Td
(are)Tj
1.4513 0 Td
(useful)Tj
2.5909 0 Td
(for)Tj
1.389 0 Td
(recovery)Tj
3.651 0 Td
(from)Tj
2.2053 0 Td
(failed)Tj
2.4038 0 Td
(transactions)Tj
5.074 0 Td
(and)Tj
-32.8704 -1.3039 Td
(retrieval)Tj
3.5093 0 Td
(of)Tj
1.0148 0 Td
(a)Tj
0.6519 0 Td
(consistent)Tj
4.2576 0 Td
(version)Tj
3.1522 0 Td
(of)Tj
1.0148 0 Td
(the)Tj
1.4683 0 Td
(database)Tj
3.6397 0 Td
(in)Tj
1.0374 0 Td
(the)Tj
1.4684 0 Td
(event)Tj
2.3697 0 Td
(that)Tj
1.7802 0 Td
(the)Tj
1.4683 0 Td
(system)Tj
2.9367 0 Td
(crashes'.)Tj
-30.5516 -1.8992 Td
()Tj
/F11 1 Tf
0.7823 0 Td
(Log)Tj
1.7688 0 Td
(file)Tj
/F5 1 Tf
(:)Tj
1.7745 0 Td
(`the)Tj
1.6951 0 Td
(log)Tj
1.44 0 Td
(files)Tj
1.8028 0 Td
(keep)Tj
2.0806 0 Td
(a)Tj
0.6577 0 Td
(record)Tj
2.8403 0 Td
(of)Tj
1.0204 0 Td
(the)Tj
1.4684 0 Td
(events)Tj
2.7269 0 Td
(that)Tj
1.7801 0 Td
(occur)Tj
2.4718 0 Td
(in)Tj
1.0375 0 Td
(the)Tj
1.4683 0 Td
(database'.)Tj
-26.8155 -1.8992 Td
()Tj
/F11 1 Tf
0.7823 0 Td
(Timeline)Tj
/F5 1 Tf
(:)Tj
4.2066 0 Td
(`creating)Tj
3.6793 0 Td
(a)Tj
0.652 0 Td
(timeline)Tj
3.5149 0 Td
(of)Tj
1.0148 0 Td
(events)Tj
2.727 0 Td
(can)Tj
1.627 0 Td
(assist)Tj
2.3017 0 Td
(an)Tj
1.2019 0 Td
(investigator)Tj
4.9153 0 Td
(to)Tj
1.0261 0 Td
(gain)Tj
1.9389 0 Td
(an)Tj
1.2019 0 Td
(insight)Tj
2.9537 0 Td
(into)Tj
1.8425 0 Td
(the)Tj
-34.8036 -1.2983 Td
(events)Tj
2.7269 0 Td
(that)Tj
1.7802 0 Td
(occurred)Tj
3.7927 0 Td
(as)Tj
1.0148 0 Td
(well)Tj
1.8198 0 Td
(as)Tj
1.0148 0 Td
(the)Tj
1.474 0 Td
(people)Tj
2.8517 0 Td
(involved.)Tj
3.8777 0 Td
(It)Tj
0.8561 0 Td
(also)Tj
1.7688 0 Td
(assists)Tj
2.6646 0 Td
(in)Tj
1.0318 0 Td
(identifying)Tj
4.5807 0 Td
(patterns)Tj
3.4696 0 Td
(and)Tj
-34.7242 -1.3039 Td
(anomalies)Tj
4.2576 0 Td
(that)Tj
1.7802 0 Td
(may)Tj
1.9275 0 Td
(reveal)Tj
2.5739 0 Td
(other)Tj
2.347 0 Td
(sources)Tj
3.1975 0 Td
(of)Tj
1.0148 0 Td
(evidence)Tj
3.7077 0 Td
(in)Tj
1.0374 0 Td
(a)Tj
0.652 0 Td
(system'.)Tj
-22.0817 -1.8992 Td
(This)Tj
1.9899 0 Td
(step)Tj
1.8198 0 Td
(requires)Tj
3.4696 0 Td
(specifying)Tj
4.2406 0 Td
(a)Tj
0.652 0 Td
(list)Tj
1.3946 0 Td
(of)Tj
1.0148 0 Td
(candidate)Tj
4.1045 0 Td
(definitions)Tj
4.5241 0 Td
(for)Tj
1.3833 0 Td
(all)Tj
1.1452 0 Td
(short-listed)Tj
4.7622 0 Td
(concepts)Tj
3.719 0 Td
(\(the)Tj
-35.4158 -1.2982 Td
(definitions)Tj
4.524 0 Td
(will)Tj
1.6611 0 Td
(be)Tj
1.1509 0 Td
(reconciled)Tj
4.3823 0 Td
(in)Tj
1.0375 0 Td
(Step)Tj
1.9332 0 Td
(3.5\).)Tj
1.9616 0 Td
(These)Tj
2.5681 0 Td
(are)Tj
1.4457 0 Td
(as)Tj
1.0148 0 Td
(follows:)Tj
3.2882 0 Td
(a)Tj
0.6519 0 Td
(Live)Tj
1.9049 0 Td
(acquisition)Tj
4.6261 0 Td
(is)Tj
0.8504 0 Td
(defined)Tj
3.2258 0 Td
(as)Tj
-36.2265 -1.2983 Td
(`)Tj
/F10 1 Tf
[()]TJ
0.9297 0 Td
[()12()15()3()]TJ
1.5477 0 Td
[( )4()22()11()]TJ
1.9899 0 Td
[()6()7()14()12()-4()10()14()7()4()11(\n)]TJ
4.5014 0 Td
[()4()7()1()12()-9()-9()12(\n)13()]TJ
3.8835 0 Td
[(3)3()6()2(\n)]TJ
2.313 0 Td
[()10()6()]TJ
1.4173 0 Td
[()7()2()9()11()2()]TJ
2.7836 0 Td
[()4()2()12(\n)13()]TJ
2.2961 0 Td
[()16(\n)6()11()15()2()-3()7( )]TJ
3.6056 0 Td
[()-4()]TJ
0.8164 0 Td
[()9()7()4()4()]TJ
1.5874 0 Td
[()-9()12(\n)18(\n)18()12(\n)13()]TJ
3.3732 0 Td
[(3)3()18()4()4()]TJ
2.2847 0 Td
[()10()6()]TJ
1.4173 0 Td
[()16(\n)6()11()15()]TJ
-34.7468 -1.3039 Td
[()10()-4()]TJ
1.1451 0 Td
[()-4()]TJ
0.8164 0 Td
[()4()2()12(\n)13()]TJ
2.2961 0 Td
[()4()2()-23()9()11()-9()6()7( )59()]TJ
/F5 1 Tf
(;)Tj
4.6374 0 Td
(a)Tj
0.6576 0 Td
(Collected)Tj
3.9742 0 Td
(Artefact)Tj
3.4412 0 Td
(is)Tj
0.8504 0 Td
(defined)Tj
3.2258 0 Td
(as)Tj
1.0148 0 Td
(`)Tj
/F10 1 Tf
[( )1()6()]TJ
1.9332 0 Td
[()7()10()4()4()7()-4()11()7( )]TJ
3.481 0 Td
[()16()-19()11()1()9()6()-4()]TJ
3.5092 0 Td
[()11()]TJ
1.0488 0 Td
[()12(\n)11()9()11()-9()6()22()7()4()11(\n)]TJ
-32.0312 -1.2983 Td
[()-3()11()12()20()7()8()]TJ
2.9933 0 Td
[()7()16(\n)]TJ
1.6101 0 Td
[()6()10()4( )]TJ
1.9219 0 Td
[()6()11()12()4()1()4()11()-4()]TJ
3.9458 0 Td
[()7()20()16(\n)-3()6()-4()7()4()11(\n)]TJ
4.9719 0 Td
[()11()]TJ
0.9808 0 Td
[()12(\n)6()7()12()3()2()]TJ
3.2995 0 Td
[()16(\n)24()]TJ
1.6668 0 Td
[()6()-4()7()15()3()]TJ
2.4717 0 Td
[()12(\n)6()16()14()10()6()11()-9(5)-3()7( )]TJ
5.4879 0 Td
[( )4()22()11()22()4()-3()]TJ
3.668 0 Td
[()6()7()7()8()10()47(.)]TJ
/F5 1 Tf
2.931 0 Td
(and)Tj
-35.9487 -1.2983 Td
(a)Tj
0.6519 0 Td
(Volatile)Tj
3.3392 0 Td
(artefact)Tj
3.1918 0 Td
(is)Tj
0.8447 0 Td
(defined)Tj
3.2258 0 Td
(as)Tj
1.0148 0 Td
(`)Tj
/F10 1 Tf
[()92()10()4()22()7()4()4()]TJ
3.4923 0 Td
[()16()-19()11()1()9()6()-4()]TJ
3.5092 0 Td
[()16()20()]TJ
1.457 0 Td
[()7()10()4()4()7()-4()7()4()11(\n)]TJ
4.1783 0 Td
[()11()]TJ
0.9524 0 Td
[()]TJ
0.5499 0 Td
[()20()15()4()22()11()7( )]TJ
2.8857 0 Td
[()3()10()4()22()7()4()4()]TJ
3.033 0 Td
[( )4()22()11()22()4()-3()]TJ
-32.326 -1.3039 Td
[()-3()2()-20()3()2()]TJ
2.4888 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[()11()4()2()20()22()7()12(\n)13()]TJ
3.9061 0 Td
[()7()2()9()11()2()]TJ
2.7836 0 Td
[()16()-19()11()1()9()6()-4()]TJ
3.5093 0 Td
[()10()4()13()]TJ
2.2847 0 Td
[()]TJ
1.0375 0 Td
[()6()2()6()11()-9()4()8()]TJ
3.9798 0 Td
[()16()-19()11()1()9()6()-4()]TJ
3.8324 0 Td
[(3)3()18()4()13()]TJ
2.5341 0 Td
[()6()10()4( )]TJ
1.9276 0 Td
[()3()10()4()22()7()4()4()]TJ
3.033 0 Td
[( )4()22()11()73()]TJ
/F5 1 Tf
(.)Tj
ET
Q
q
1 j
1 J
0 w
11.9999 0 0 11.9999 200.0125 294.9732 cm
BT
/F0 1 Tf
1 TL
-0.0033 Tc
0 0 Td
(3.5)Tj
1.5921 0 Td
(Reconciliation)Tj
6.3544 0 Td
(of)Tj
1.0488 0 Td
(definitions)Tj
ET
Q
q
1 j
1 J
0 w
10 0 0 10 200.0125 278.022 cm
BT
/F5 1 Tf
1 TL
-0.004 Tc
0 0 Td
(Explicit)Tj
3.2654 0 Td
(definitions)Tj
4.5184 0 Td
(are)Tj
1.4457 0 Td
(important)Tj
4.2746 0 Td
(in)Tj
1.0318 0 Td
(science,)Tj
3.3052 0 Td
(as)Tj
1.0091 0 Td
(they)Tj
1.9219 0 Td
(improve)Tj
3.5716 0 Td
(communication)Tj
6.6047 0 Td
(and)Tj
1.7291 0 Td
(understand-)Tj
-32.6775 -1.3039 Td
(ing.)Tj
1.7234 0 Td
(Precise)Tj
3.0501 0 Td
(definitions)Tj
4.524 0 Td
(help)Tj
1.9332 0 Td
(to)Tj
1.0262 0 Td
(ensure)Tj
2.8743 0 Td
(that)Tj
1.7801 0 Td
(we)Tj
1.3266 0 Td
(are)Tj
1.4514 0 Td
(talking)Tj
2.9763 0 Td
(about)Tj
2.4945 0 Td
(the)Tj
1.4683 0 Td
(same)Tj
2.2564 0 Td
(phenomena.)Tj
5.1987 0 Td
(Further,)Tj
-34.0835 -1.2982 Td
(they)Tj
1.9218 0 Td
(also)Tj
1.7688 0 Td
(assist)Tj
2.3018 0 Td
(in)Tj
1.0374 0 Td
(avoiding)Tj
3.6907 0 Td
(circular)Tj
3.2825 0 Td
(thinking)Tj
3.6397 0 Td
(where)Tj
2.6532 0 Td
(what)Tj
2.16 0 Td
(appears)Tj
3.2825 0 Td
(as)Tj
1.0148 0 Td
(a)Tj
0.6519 0 Td
(thesis)Tj
2.4605 0 Td
(is)Tj
0.8447 0 Td
(only)Tj
1.9786 0 Td
(a)Tj
0.6519 0 Td
(redundant)Tj
-33.3408 -1.2983 Td
(restatement)Tj
4.9209 0 Td
(of)Tj
1.0148 0 Td
(basic)Tj
2.211 0 Td
(assumptions)Tj
5.2214 0 Td
([)Tj
0.83 0.64 0.02 0 k
(99)Tj
0 g
(].)Tj
2.0749 0 Td
(Differences)Tj
4.7735 0 Td
(between)Tj
3.532 0 Td
(definitions)Tj
4.524 0 Td
(are)Tj
1.4457 0 Td
(reconciled)Tj
4.3823 0 Td
(in)Tj
1.0375 0 Td
(this)Tj
-35.138 -1.3039 Td
(step.)Tj
2.0466 0 Td
(In)Tj
1.1055 0 Td
(choosing)Tj
3.8267 0 Td
(or)Tj
1.0998 0 Td
(synthesizing)Tj
5.1534 0 Td
(the)Tj
1.474 0 Td
(common)Tj
3.8438 0 Td
(concept)Tj
3.3618 0 Td
(definition)Tj
4.1613 0 Td
(to)Tj
1.0261 0 Td
(be)Tj
1.1509 0 Td
(used,)Tj
2.2847 0 Td
(definitions)Tj
4.524 0 Td
(short-)Tj
-35.0586 -1.2983 Td
(listed)Tj
2.3414 0 Td
(in)Tj
1.0374 0 Td
(Step)Tj
1.9332 0 Td
(3.4)Tj
1.4003 0 Td
(are)Tj
1.4457 0 Td
(considered.)Tj
-6.9618 -1.2982 Td
(The)Tj
1.7858 0 Td
(definitions)Tj
4.524 0 Td
(have)Tj
2.058 0 Td
(been)Tj
2.126 0 Td
(developed)Tj
4.2689 0 Td
(by)Tj
1.1792 0 Td
(various)Tj
3.1464 0 Td
(people)Tj
2.8517 0 Td
(with)Tj
2.0012 0 Td
(varying)Tj
3.2145 0 Td
(backgrounds)Tj
5.3858 0 Td
(and)Tj
1.7348 0 Td
(per-)Tj
-35.4725 -1.304 Td
(spectives.)Tj
3.9741 0 Td
(If)Tj
0.8504 0 Td
(there)Tj
2.262 0 Td
(is)Tj
0.8504 0 Td
(a)Tj
0.652 0 Td
(conflicting)Tj
4.5014 0 Td
(use)Tj
1.5307 0 Td
(of)Tj
1.0148 0 Td
(concept)Tj
3.3618 0 Td
(definition)Tj
4.1669 0 Td
(between)Tj
3.5263 0 Td
(two)Tj
1.7121 0 Td
(or)Tj
1.0942 0 Td
(more)Tj
2.3414 0 Td
(sources,)Tj
3.4242 0 Td
(then)Tj
-35.2627 -1.2982 Td
(a)Tj
0.6519 0 Td
(process)Tj
3.1861 0 Td
(to)Tj
1.0262 0 Td
(reconcile)Tj
3.8551 0 Td
(and)Tj
1.7291 0 Td
(fit)Tj
1.0715 0 Td
(the)Tj
1.4683 0 Td
(definition)Tj
4.1669 0 Td
(is)Tj
0.8447 0 Td
(required.)Tj
3.8665 0 Td
(Some)Tj
2.4434 0 Td
(models)Tj
3.1068 0 Td
(neglect)Tj
3.05 0 Td
(to)Tj
1.0262 0 Td
(explicitly)Tj
-31.4927 -1.2983 Td
(define)Tj
2.6985 0 Td
(some)Tj
2.3301 0 Td
(of)Tj
1.0148 0 Td
(their)Tj
2.1089 0 Td
(concepts.)Tj
3.9458 0 Td
(In)Tj
1.1112 0 Td
(such)Tj
2.058 0 Td
(cases,)Tj
2.4491 0 Td
(they)Tj
1.9219 0 Td
(do)Tj
1.2585 0 Td
(not)Tj
1.5704 0 Td
(provide)Tj
3.2882 0 Td
(any)Tj
1.6611 0 Td
(input)Tj
2.3754 0 Td
(to)Tj
1.0261 0 Td
(the)Tj
1.4684 0 Td
(reconcilia-)Tj
-32.2864 -1.2983 Td
(tion)Tj
1.8425 0 Td
(process.)Tj
3.4072 0 Td
(As)Tj
1.2642 0 Td
(an)Tj
1.2019 0 Td
(example,)Tj
3.7757 0 Td
(the)Tj
1.4684 0 Td
(concept)Tj
3.3618 0 Td
(of)Tj
1.0148 0 Td
(Data)Tj
2.126 0 Td
(File)Tj
1.6838 0 Td
(is)Tj
0.8447 0 Td
(defined)Tj
3.2258 0 Td
(differently)Tj
4.3597 0 Td
(in)Tj
1.0374 0 Td
(five)Tj
1.6498 0 Td
(models)Tj
3.1067 0 Td
(as)Tj
-35.3704 -1.3039 Td
(follows.)Tj
3.2824 0 Td
(Fowler)Tj
2.9821 0 Td
([)Tj
0.83 0.64 0.02 0 k
(94)Tj
0 g
(])Tj
1.8482 0 Td
(defines)Tj
3.0614 0 Td
(it)Tj
0.788 0 Td
(as)Tj
1.0148 0 Td
(`a)Tj
/F10 1 Tf
0.8787 0 Td
[( )4()22()11()]TJ
1.9843 0 Td
[()-8()4()4()]TJ
1.3832 0 Td
[(3)3()6()2()20()]TJ
2.5342 0 Td
[()10()6()]TJ
1.4173 0 Td
[( )4()22()11()22()4()-3()]TJ
3.6737 0 Td
[()9()11()11()20()8()]TJ
2.3924 0 Td
[()10()6()]TJ
1.4173 0 Td
[()-5()3()2(\n)22()47()]TJ
/F5 1 Tf
(.)Tj
3.0274 0 Td
(Khanuja)Tj
3.6227 0 Td
([)Tj
0.83 0.64 0.02 0 k
(3)Tj
0 g
(])Tj
-35.3081 -1.2982 Td
(defines)Tj
3.0557 0 Td
(it)Tj
0.788 0 Td
(as)Tj
1.0148 0 Td
(`)Tj
/F10 1 Tf
[( )4()22()11()]TJ
2.211 0 Td
[()-8()4()4()8()]TJ
1.7121 0 Td
[()22()11()6()13()6()7( )]TJ
3.5547 0 Td
[()11()]TJ
0.9864 0 Td
[()]TJ
0.703 0 Td
[()7()-9()-4()9()11()7( )]TJ
2.9253 0 Td
[()9()11()20()2(\n)10()4()]TJ
3.2032 0 Td
[()6()6()13()18()12(\n)6()]TJ
3.5489 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[()-4()-3()7( )]TJ
1.9673 0 Td
[()11()]TJ
0.9807 0 Td
[()10()10()11()4()11()-19()]TJ
3.1521 0 Td
[()6()-4()7()15()-13()14()-3()]TJ
3.0785 0 Td
[()20()7()7()11(\n)]TJ
-34.6108 -1.2983 Td
[()9()7()-9()4()-4()7()4()11(\n)]TJ
3.668 0 Td
[()16()-19()11()1()9()6()-4()]TJ
3.1747 0 Td
[()16(\n)6()11()15()2()10()-4()]TJ
/F5 1 Tf
('.)Tj
3.7588 0 Td
(Fru)Tj
0 Tc
0.9751 0 Td
()Tj
-0.004 Tc
0.4535 0 Td
(hwirt)Tj
2.3698 0 Td
([)Tj
0.83 0.64 0.02 0 k
(95)Tj
0 g
(])Tj
1.8481 0 Td
(defines)Tj
3.0614 0 Td
(it)Tj
0.7824 0 Td
(as)Tj
1.0148 0 Td
()Tj
/F10 1 Tf
[()-6()22()11()22()4()-3()8()]TJ
4.5921 0 Td
[()9()11()11()20()]TJ
2.0636 0 Td
[()10()6()2()12()]TJ
2.0466 0 Td
[()7()11(\n)22()11()2(\n)22()]TJ
3.1011 0 Td
[()12(\n)]TJ
1.0148 0 Td
[()-3()7()11()4()4()7( )]TJ
-33.9248 -1.3039 Td
[( )4()22()11()]TJ
1.9842 0 Td
[()-8()4()4()8()]TJ
1.7121 0 Td
[()12(\n)]TJ
1.0148 0 Td
[()10()6()]TJ
1.4173 0 Td
[()-8()4()4()]TJ
1.3833 0 Td
[()7()2()9()11()2()]TJ
/F5 1 Tf
(.)Tj
3.4016 0 Td
(Adedayo)Tj
3.7757 0 Td
([)Tj
0.83 0.64 0.02 0 k
(96)Tj
0 g
(])Tj
1.8538 0 Td
(defines)Tj
3.0558 0 Td
(it)Tj
0.788 0 Td
(as)Tj
1.0148 0 Td
()Tj
/F10 1 Tf
[( )1()6()]TJ
2.1033 0 Td
[( )4()22()11()]TJ
1.9842 0 Td
[()-8()4()4()8()]TJ
1.7121 0 Td
[()16()20()]TJ
1.457 0 Td
[()-4()-3()7( )]TJ
1.9673 0 Td
[()11()]TJ
0.9864 0 Td
[()9()11()11()20()]TJ
2.0636 0 Td
[( )4()22()11()22()4()-3()]TJ
-33.6753 -1.2983 Td
[()13()11(7)3()7()-4()]TJ
2.8062 0 Td
[()10()4()13()]TJ
1.9559 0 Td
[()]TJ
1.0375 0 Td
[()11()22()10()4()8()]TJ
2.4378 0 Td
[()16(\n)6( )]TJ
1.7291 0 Td
[()11()20()4()7()7( )12()12()20()8()47(+)]TJ
/F5 1 Tf
(.)Tj
4.9889 0 Td
(Fowler's)Tj
3.5547 0 Td
(definition)Tj
4.1669 0 Td
(is)Tj
0.8447 0 Td
(too)Tj
1.5307 0 Td
(specific)Tj
3.1918 0 Td
(to)Tj
1.0261 0 Td
(database)Tj
3.6397 0 Td
(events.)Tj
ET
Q
q
1 j
1 J
0 w
576 737.1 m
36 737.1 l
36 737.6 l
576 737.6 l
f*
36 741.2598 107.1496 23.6976 re
W* n
q
107.0929 0 0 23.6409 36 741.3165 cm
q
/I0 Do
Q
Q
Q
q
0 0 612 792 re
W* n
1 j
1 J
0 w
7.9999 0 0 7.9999 328.0251 745.7952 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(Developme)Tj
4.9677 0 Td
(nt)Tj
1.0417 0 Td
(and)Tj
1.8568 0 Td
(validation)Tj
4.3583 0 Td
(of)Tj
1.0417 0 Td
(a)Tj
0.7654 0 Td
(Databas)Tj
3.6567 0 Td
(e)Tj
0.7653 0 Td
(Forensic)Tj
3.9898 0 Td
(Metamodel)Tj
5.0883 0 Td
(\(DBFM\))Tj
ET
Q
q
1 j
1 J
0 w
36 48.0002 m
576 48.0002 l
576 47.5002 l
36 47.5002 l
f*
7.9999 0 0 7.9999 36 36 cm
BT
/F0 1 Tf
1 TL
-0.005 Tc
0 0 Td
(PLOS)Tj
2.8559 0 Td
(ONE)Tj
2.3669 0 Td
(|)Tj
0.4748 0 Td
(DOI:10.137)Tj
5.0387 0 Td
(1/journal.po)Tj
5.1236 0 Td
(ne.0170)Tj
3.5434 0 Td
(793)Tj
2.6362 0 Td
(February)Tj
4.1599 0 Td
(1,)Tj
1.0417 0 Td
(2017)Tj
37.8995 0 Td
(8)Tj
0.7654 0 Td
(/)Tj
ET
endstream
endobj
237 0 obj
<>stream
endstream
endobj
238 0 obj
<>stream
endstream
endobj
239 0 obj
<>stream
endstream
endobj
240 0 obj
<>stream
endstream
endobj
241 0 obj
<>stream
endstream
endobj
242 0 obj
<>stream
endstream
endobj
243 0 obj
<>stream
endstream
endobj
244 0 obj
<>stream
endstream
endobj
245 0 obj
<>stream
endstream
endobj
246 0 obj
<>stream
endstream
endobj
247 0 obj
<>stream
BT
66.402 0 Td
(34)Tj
ET
Q
endstream
endobj
248 0 obj
<>/XObject<>>>/CropBox[0 0 612 792]/MediaBox[0 0 612 792]/Parent 10 0 R/Annots 253 0 R/Contents 254 0 R/TrimBox[0 0 612 792]>>
endobj
250 0 obj
<>stream
JFIF C
$, !$4.763.22:ASF:=N>22HbINVX]^]8EfmeZlS[]Y C**Y;2;YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY "
} !1AQa"q2#BR$3br
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
w !1AQaq"2B #3Rbr
$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ? h渟JE BMkͿ +
4W/?6 hk _+\~m _V ۚ9'Эq G%~" Zo&;nh渟JE BMkͿ +
4W/?6 hk _+\~m _V ۚ`b\g%~" Zo&F$rFgC[ o3)d2GJc7');#%֖osҀ6=( 2=( 2=( 2=( 2=( 2=( 2=( 2=)(j4Q@QFnP
endstream
endobj
251 0 obj
<>stream
JFIF C
$, !$4.763.22:ASF:=N>22HbINVX]^]8EfmeZlS[]Y C**Y;2;YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY N "
} !1AQa"q2#BR$3br
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
w !1AQaq"2B #3Rbr
$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ? (
ZJZ ( ( ( ( ))i(+