Abstract
In the forensic analysis of computer devices, professionals are facing an increasingly large volume of data to examine. Storage units are the main permanent repositories used in these analyses and are becoming larger and storing an equally large amount of information. One option for dealing with this situation is the use of the principles of reference locality, which are based on the fundamentals of recency, frequency and grouping of resources, with the aim of reducing the time required or spatial scope of forensic examinations. For this research, the legacies of the computer scientist Peter Denning were used, who noticed a trend of temporal concentration in smaller memory areas, which enabled the construction of a memory hierarchy combing several distinct technologies to improve the overall performance of the system at a relatively cost. To apply the proposed technique, storage media with Windows operating system structures and consolidating artifacts of recency and frequency of access to files, folders and programs were used. The results obtained are promising for reducing the accumulation of computer equipment awaiting forensic analysis in Brazilian custody warehouses, promoting a reduction of 759,161 files or folders to be analyzed to 12,597 folders or files initially analyzed. By analyzing a representative subset of the original data, it was possible to conclude about the materiality, authorship, and dynamics of the conducts provided for in the Statute od the Child and Adolescent, which made it possible to reduce the time of expert analysis and consequent delivery of the expert report.