An automated solution to the multiuser carved data ascription problem

IEEE Transactions on Information Forensics and Security

Volumn 5, Issue 4, 2010, Pages 868-882

  Garfinkel, Simson L ^a   Parker Wood, Aleatha ^b   Huynh, Daniel ^c   Migletz, James ^d  

^a NAVAL POSTGRADUATE SCHOOL   (United States)

^b University of California Santa Cruz   (United States)

^c UNITED STATES MILITARY ACADEMY   (United States)

^d Headquarters US Marine Corps   (United States)

Author keywords

Data mining; forensics; information security

Indexed keywords

AUTOMATED SOLUTIONS; CROSS VALIDATION; DISK DRIVE; DISK IMAGES; FILE CARVING; FILE SYSTEMS; FORENSIC EXAMINATIONS; FORENSICS; HARD DRIVES; INFORMATION SECURITY; MACHINE-LEARNING; MANUAL INSPECTION; MULTI-USER; NOVEL SOLUTIONS; SECONDARY MARKET; STORAGE MEDIA; TIME STAMPS;

CLASSIFIERS; COMPUTER CRIME; DISKS (STRUCTURAL COMPONENTS); DRIVES; METADATA; SECURITY OF DATA;

DATA MINING;

EID: 78649436854     PISSN: 15566013     EISSN: None     Source Type: Journal    
DOI: 10.1109/TIFS.2010.2060484     Document Type: Article

References (20)

1. R. A. Bosch and J. A. Smith, "Separating hyperplanes and the authorship of the disputed federalist papers", Amer. Math. Monthly, vol. 105, pp. 601-608, 1998.
2. B. Carrier, The Sleuth Kit and Autopsy: Forensics Tools for Linux and Other Unixes 2005 [Online]. Available: http://www.sleuthkit.org/, accessed 06 March 2009
3. B. V. Dasarathy, Nearest Neighbor: Pattern Classification Techniques (Nn Norms: Nn Pattern Classification Techniques). Los Alamitos, CA: IEEE Comput. Soc. Press, 1990.
4. J. Friedman, Y. Y. Yun, and R. Kohavi, "Lazy decision trees", in Proc. 13th Nat. Conf. Artificial Intelligence, Portland, OR, 1996.
5. S. L. Garfinkel, "Forensic feature extraction and cross-drive analysis", in Proc. 6th Annual Digital Forensic Research Workshop (DFRWS), Lafayette, IN, Aug. 2006, Elsevier.
6. S. L. Garfinkel, "Automating disk forensic processing with sleuthkit, XML and Python", in Proc. Fourth Int. IEEE Workshop on Systematic Approaches to Digital Forensic Engineering, Oakland, CA, 2009.
7. S. L. Garfinkel, P. Farrell, V. Roussev, and G. Dinolt, "Bringing science to digital forensics with standardized forensic corpora", in Proc. 9th Annual Digital Forensic Research Workshop (DFRWS), Quebec, Canada, Aug. 2009.
8. A. Haeberlen, P. Kouznetsov, and P. Druschel, "Peerreview: Practical accountability for distributed systems", in Proc. Twenty-First ACM SIGOPS Symp. Operating Systems Principles (SOSP'07), New York, 2007, pp. 175-188, ACM.
9. D. Holmes, "Authorship attribution", Computers and the Humanities, vol. 28, pp. 87-106, 1994.
10. G. G. Ra III and V. Roussev, "Scalpel: A frugal, high performance file carver", in Proc. 2005 Digital Forensics Research Workshop (DFRWS), New Orleans, LA, Aug. 2005.
11. R. Kohavi, A Study of Cross-Validation and Bootstrap for Accuracy Estimation and Model Selection. San Mateo, CA: Morgan Kaufmann, 1995, pp. 1137-1143.
12. Ccleaner 2009, P. Ltd.
13. J. Lyle, "If error rate is such a simple concept, why don't I have one for my forensic tool yet?", in Proc. 10th Annual DFRWS Conf., Portland, OR, 2010.
14. J. Migletz, "Automated Metadata Extraction", Master's thesis, Naval Postgraduate School, Monterey, CA, 2008.
15. N. Mikus, "An Analysis of Disc Carving Techniques", Master's thesis, Naval Postgraduate School, Mar. 2005.
16. F. Mosteller and D. L. Wallace, "Inference in an authorship problem", J. Amer. Statist. Assoc., vol. 58, pp. 275-309, 1963.
17. J. R. Quinlan, C4.5: Programs for Machine Learning. San Francisco, CA: Morgan Kaufmann, 1993.
18. Daubert v. Merrell Dow Pharmaceuticals 509 US 579, 1993.
19. S. Y. Willassen, "Methods for Enhancement of Timestamp Evidence in Digital Investigations", Ph. D. thesis, Norwegian Univ. Science and Technology, Norway, 2008.
20. I. H. Witten and E. Frank, Data Mining: Practical Machine Learning Tools and Techniques, 2nd ed. San Francisco, CA: Morgan Kaufmann, 2005.