A system for the proactive, continuous, and efficient collection of digital forensic evidence

Digital Investigation

Volumn 8, Issue SUPPL., 2011, Pages

  Shields, Clay ^a   Frieder, Ophir ^a   Maloof, Mark ^a  

^a GEORGETOWN UNIVERSITY   (United States)

Author keywords

Deleted file logging; Evidence collection; File similarity; Proactive forensics; Search

Indexed keywords

SEARCH ENGINES; SEMANTICS;

DELETED FILES; EVIDENCE COLLECTION; FILE SIMILARITY; PROACTIVE FORENSICS; SEARCH;

DIGITAL FORENSICS;

EID: 79961078119     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2011.05.002     Document Type: Conference Paper

References (40)

1. US v. Ziegler January 2007 http://caselaw.findlaw.com/us-9th-circuit/ 1102459.html United States Court of Appeals, Ninth Circuit. No. 05-30177 (1-30-07)
2. Aggarwal S, Henry P, Kermes L, Mulholland J. Evidence handling in proactive cyberstalking investigations: the PAPA approach. In: Systematic approaches to digital forensic engineering. 2005. p. 165-176.
3. Bishop M. A standard audit trail format. In: National Information Systems Security'95 (18th) proceedings: making security real. 1996. p. 136.
4. C. Boyd, and P. Forster Time and date issues in forensic computing: a case Study Digital Investigation 1 February 2004 18 23
5. Bradford PG, Hu N. A layered approach to insider threat detection and proactive forensics. In: Annual Computer Security Applications Conference (ACSAC). Tuscon, AZ: December 2005.
6. Bradford P, Brow M, Perdue J, Self B. Towards proactive computer-system forensics. In: International conference on information technology: coding and computing. 2004. p. 648-652.
7. Buchholz F. Falk C. Design and Implementation of zeitline: a forensic timeline editor. In: Digital Forensics Research Workshop. 2005. p. 1-7.
8. F. Buchholz, and E. Spafford On the role of file system metadata in digital forensics Digital Investigation 1 2004 298 309
9. E. Bumiller Ex-Hacker Army leak suspect is turned in June 2010 New York Times http://www.nytimes.com/2010/06/08/world/08leaks.html
10. Burges C, Plastina D, Platt J, Renshaw E, Malvar H. Using audio fingerprinting for duplicate detection and thumbnail generation. In: Proc. acoustics, speech, and signal processing. 2005. p. 1-4.
11. B. Carrier File system forensic analysis 2005 Addison-Wesley Professional
12. A. Chowdhury, O. Frieder, D. Grossman, and M.C. McCabe Collection statistics for fast duplicate document detection ACM Transactions on Information Systems 20 2002 171 191 (Pubitemid 44642301)
13. Cooper JW, Coden AR, Brown EW. Detecting similar documents using salient terms. In: Proceedings of the eleventh international conference on information and knowledge management. 2002. p. 245.
14. D. Grossman, and O. Frieder Information retrieval 2nd ed. 2004 Springer
15. Heintze N. Scalable document fingerprinting. In: USENIX workshop on electronic commerce. 1996.
16. Herrerias J, Gomez R. A log correlation model to support the evidence search process in a forensic investigation. In: second international workshop on Systematic Approaches to Digital Forensic Engineering (SADFE'07). April 2007. p. 31-32.
17. T. Hoad, and J. Zobel Detection of video sequences using compact signatures ACM Transactions on Information Systems 24 January 2006 1 50
18. Keeney M, Kowalski E, Cappelli D, Moore A, Shimeall T, Rodgers S. Insider threat study: computer system sabotage in critical infrastructure sectors. Tech. rep., U.S. Secret Service and SEI at CMU. May 2005.
19. Klimt B, Yang Y. Introducing the Enron Corpus. In: First conference on email and anti-spam (CEAS). 2004.
20. J. Kornblum Identifying almost identical files using context triggered piecewise hashing Digital Investigation 3 2006 91 97 (Pubitemid 44088492)
21. N. Lothian Classifier4j February 2005 http://classifier4j.sourceforge.net
22. V. Luoma Computer forensics and electronic discovery: the new management challenge Computers & Security 25 March 2006 91 96 (Pubitemid 43344208)
23. Manber U. Finding similar files in a large file system. In: Proceedings of the USENIX Winter 1994 technical conference. Berkeley, CA: 1994.
24. W. Neuman A man with muffin secrets, but no job with them August 2010 New York Times http://www.nytimes.com/2010/08/07/business/07muffin.html
25. Oberheide J, Cooke E, Jahanian F. CloudAV: N-version antivirus in the network cloud. In: Proceedings of the 17th USENIX security symposium. San Jose, CA: July 2008.
26. J. Olsson, and M. Boldt Computer forensic timeline visualization tool Digital Investigation 6 September 2009 S78 S87
27. Oracle, Oracle outside in technology. http://www.oracle.com/technology/ products/content-management/oit/oit-all.html.
28. Paintsil AB. Insider threat detection: a proactive forensic approach. Master's thesis, Stockholm University/The Royal Institute of Technology, Stockholm. Sweden. May 2007.
29. Picciotto J. The design of an effective auditing subsystem. In: Proceedings of the 1987 symposium on security and privacy. 1987. p. 13-22.
30. Ponec M, Giura P, Brönnimann H, Wein J. Highly efficient techniques for network forensics. In: Proceedings of the 14th ACM conference on Computer and Communications Security. 2007. p. 150-160.
31. M.F. Porter An algorithm for suffix stripping Readings in Information Retrieval 1997 313 316
32. Roussev V, III, Richard G, Marziale L. Multi-resolution similarity hashing. In: Digital Forensics Research Conference (DFRWS). 2007. p. 105-113. (Pubitemid 47081445)
33. Sandler D, Derr K, Crosby S, Wallach DS. Finding the evidence in tamper-evident logs. In: 2008 Third international workshop on systematic approaches to digital forensic engineering. May 2008. p. 69-75.
34. B. Schneier, and J. Kelsey Secure audit logs to support computer forensics ACM Transactions on Information and System Security (TISSEC) 2 1999 159 176
35. S. Shafi, and R. Rather Precision and recall of five search engines for retrieval of scholarly information in the field of Biotechnology Webology 2 2 August 2005
36. Shields C, Frieder O, Maloof M. A novel system for the proactive, continuous, and efficient collection of digital forensic evidence. Tech. Rep. CSTR-20100415-1, Georgetown University. 2010.
37. Shields C. Towards proactive forensic evidentiary collection. In: Hawaii International Conference on System Sciences (HICSS). January 2010.
38. Srinivasan SH, Sawant N. Finding near-duplicate images on the web using fingerprints. In: Proceeding of the 16th ACM international conference on Multimedia. 2008. p. 881.
39. Takahashi D, Xiao Y. Complexity analysis of retrieving knowledge from auditing log files for computer and network forensics and accountability. In: 2008 IEEE International Conference on Communications. May 2008. p. 1474-1478.
40. Wee C. LAFS: a logging and auditing file system. In: Annual computer security applications conference. 1995. p. 1-10.