proposed Forensic Feature Extraction (FFE) and Cross Drive Analysis (CDA) techniques to analyze large data sets of disk images and other types of forensic data. These two methods were used for prioritizing and systematically identifying social networks usage in the suspect’s system.