Behavioral Anomaly Detection in Forensics Analysis