Forensic feature extraction and cross-drive analysis

Digital Forensic Research Workshop 2006

Volumn , Issue , 2006, Pages

  Garfinkel, Simson L ^a  

^a HARVARD UNIVERSITY   (United States)

Author keywords

Computer forensics; Cross Drive Analysis; Data analysis; Forensic Feature Extraction; Information extraction

Indexed keywords

CROSS-DRIVE ANALYSIS; DISCRETE STEP; DISK IMAGES; EXTRACTING INFORMATION; FINANCIAL RECORDS; FIRST-ORDER; FORENSIC DATA; HIGH CONCENTRATION; INFORMATION EXTRACTION; LARGE DATASETS; REPORT GENERATION; SECONDARY MARKET; SOCIAL NETWORKS; STATISTICAL TECHNIQUES;

COMPUTER FORENSICS; DATA MINING; DATA REDUCTION; DRIVES; ELECTRONIC CRIME COUNTERMEASURES; FEATURE EXTRACTION; IMAGE PROCESSING;

DIGITAL STORAGE;

EID: 78651545956     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1016/j.diin.2006.06.007     Document Type: Conference Paper

References (18)

1. Basis Technology. Rosette linguistics platform, 〈http://www. basistech.com/products/〉; 2006.
2. Carrier Brian. The Sleuth Kit & Autopsy: forensics tools for Linux and other Unixes, 〈http://www.sleuthkit.org/〉; 2005.
3. Computing System Innovations. Intellidact: CSI technology for automated redaction and indexing, 〈http://www.csisoft.com/applications/intellidact. php〉; 2006.
4. Crocker D. RFC 822: standard for the format of ARPA Internet text messages; August 13, 1982. See also STD0011. Obsoletes RFC0733. Updated by RFC1123, RFC1138, RFC1148, RFC1327, RFC2156. Status: STANDARD.
5. Edelson RA, Krolik JH. The discrete correlation function: a new method for analyzing unevenly sampled variable data. The Astrophysics Journal 15 October 1988;333:646-59.
6. Federal Trade Commission. Disposal of consumer report information and records, final rule, 〈http://www.ftc.gov/os/2004/11/041118disposalfrn. pdf〉; November 2004.
7. Garfinkel Simson, Shelat Abhi. Remembrance of data passed. IEEE Security and Privacy Magazine; January 2002.
8. Garfinkel Simson L, Malan David J, Dubec Karl-Alexander, Stevens Christopher C, Pham Cecile. Disk imaging with the advanced forensic format, library and tools. In: Research advances in digital forensics (second annual IFIP WG 11.9 international conference on digital forensics). Springer, in press.
9. Goan Terrance. A cop on the beat: collecting and appraising intrusion evidence. Communications of the ACM 1999;42(7). ISSN: 0001-0782:46-52. (Pubitemid 129569607)
10. Goldfoot Josh. The computer language shootout, 〈http://shootout. alioth.debian.org/〉; 2006.
11. Guidance Software, Inc. EnCase Forensic, 〈http://www. guidancesoftware.com/products/ef-index.asp〉.
12. Ning Peng, Cui Yun, Reeves Douglas S. Constructing attack scenarios through correlation of intrusion alerts. In: CCS'02 proceedings of the ninth ACM conference on computer and communications security. New York, NY, USA: ACM Press, ISBN 1-58113-612-9; 2002. p. 245-54.
13. Paxson Vern. Flex, version 2.5, a fast scanner generator. 2.5 edition. The Free Software Foundation, 〈http://www.gnu.org/software/flex/manual/ 〉; March 1995.
14. Qualys. Qualys IDS correlation daemon, 〈http://quidscor.soruceforge. net/〉; October 2003.
15. The fair and accurate credit transactions act of 2003; 2003 [Public Law 108-159, 117 Stat. 1952].
16. US Congress. Federal rules of evidence, 〈http://www.law.cornell.edu/ rules/fre/〉; 2004.
17. Valdes Alfonso, Skinner Keith. Probabilistic alert correlation. In: Proceedings of the fourth international symposium on recent advances in intrusion detection (RAID), vol. 2212 [Lecturenotes in Computer Science]; 2001.
18. Workshare. Workshare unveils the workshare protect enterprise suite to cure information leakage without crippling business, 〈http://www.workshare. com/company/news/pressreleases/prelease-54.aspx〉; 2006.