Lessons learned writing digital forensics tools and managing a 30TB digital evidence corpus

Digital Investigation

Volumn 9, Issue SUPPL., 2012, Pages

  Garfinkel, Simson ^a  

^a NAVAL POSTGRADUATE SCHOOL   (United States)

Author keywords

Digital corpora; Digital forensics; Lessons learned

Indexed keywords

ELECTRONIC CRIME COUNTERMEASURES; SOFTWARE TESTING;

DATA TYPE; DIGITAL CORPORA; DIGITAL EVIDENCE; LESSONS LEARNED; SKILL SETS; SOFTWARE RUN;

DIGITAL FORENSICS;

EID: 84864614764     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2012.05.002     Document Type: Conference Paper

References (38)

1. Access Data FTK imager 2011
2. Apple Computer Apple Remote Desktop: how to disable build-hd-index 2012
3. R. Böhme, F.C. Freiling, T. Gloe, and M. Kirchner Multimedia forensics is not computer forensics IWCF'09: proceedings of the 3rd international workshop on computational forensics 2009 Springer-Verlag Berlin, Heidelberg 90 103
4. Casey E. Confronting encryption in computer investigations: practical lessons. In: Proceedings of the 2002 DFRWS conference; 2002.
5. M.I. Cohen, S. Garfinkel, and B. Schatz Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow Proceedings of DFRWS 2009 2009 Elsevier Montreal, Canada
6. A.D. Diaz GNU ddrescue manual 2012
7. G. Dinolt, B. Allen, D. Canright, and S. Garfinkel Parallelizing SHA-256, SHA-1 MD5 and AES on the cell Broadband engine Technical Report NPS-CS-10-11 2010 Naval Postgraduate School Monterey, CA
8. J. Elson, and S. Garfinkel Tcpflow 2011
9. Garfinkel S. Digital Forensics XML. Digital Investigation; 2012:8:161-174.
10. S. Garfinkel, and L. Cranor Institutional review boards and your research Communications of the ACM 2010 38 40
11. S. Garfinkel, A. Nelson, D. White, and V. Roussev Using purpose-built functions and block hashes to enable small block and sub-file forensics Proc. of the tenth annual DFRWS conference 2010 Elsevier Portland, OR
12. S. Garfinkel, and A. Shelat Remembrance of data passed IEEE Security and Privacy 1 1 2003 17 27
13. Garfinkel SL. Design principles and patterns for computer systems that are simultaneously secure and usable. Ph.D. thesis; MIT; Cambridge, MA; 2005.
14. S.L. Garfinkel IRBs and security research: myths, facts and mission creep Usability, psychology and security 2008 (Co-located with the 5th USENIX symposium on Networked Systems Design and Implementation (NSDI'08)) 2008 Usenix San Francisco, CA
15. S.L. Garfinkel Providing cryptographic security and evidentiary chain-of-custody with the advanced forensic format, library, and tools The International Journal of Digital Crime and Forensics 1 2009 1 28
16. S.L. Garfinkel, P. Farrell, V. Roussev, and G. Dinolt Bringing science to digital forensics with standardized forensic corpora Proceedings of the 9th Annual Digital Forensic Research Workshop (DFRWS) 2009 Elsevier Quebec, CA
17. S.L. Garfinkel, D.J. Malan, K.A. Dubec, C.C. Stevens, and C. Pham Disk imaging with the advanced forensic format, library and tools Research advances in digital forensics (Second annual IFIP WG 11.9 international conference on digital forensics) 2006 Springer
18. C. Grenier Photorec 2011 http://www.cgsecurity.org/wiki/PhotoRec [accessed 03.12.11]
19. Guidance Software Form 10-q 2011
20. Harrison W. A lessons learned repository for computer forensics. In: Proceedings of the 2002 DFRWS conference; 2002.
21. H. Hibshi, T. Vidas, and L. Cranor Usability of forensics tools: a user study IT Security Incident Management and IT Forensics (IMF), 2011 sixth international conference on 2011 IEEE 81 91
22. Kim K, Park S, Chang T, Lee C, Baek S. Lessons learned from the construction of a Korean software reference data set for digital forensics. In: Proceedings of the 2009 DFRWS conference; 2009.
23. G. Klein Jflex: the fast scanner generator for java 2009
24. J. Kornblum md5deep and hashdeep - latest version 4.1 2011 http://md5deep.sourceforge.net/ [accessed 18.02.12]
25. T.F. Lawson Before the verdict and beyond the verdict: the CSI infection within modern criminal jury trials Loyola University Chicago Law Journal 41 1 2009
26. J. Metz libewf: project info 2008 http://sourceforge.net/projects/libewf/ [accessed 03.12.11]
27. Nelson AJ. RegXML: XML conversion of the Windows Registry for forensic processing and distribution. In: Chow KP, Shenoi S, editors. Advances in digital forensics VIII, in press. Springer; IFIP Advances in Information and Communication Technology; 2012.
28. J.K. Reynolds, and J. Postel RFC 1000: request for comments reference guide 1987 Obsoletes RFC0999
29. R.C. Shelby September 11 and the imperative of reform in the U.S. Intelligence Community 2002 Additional Views of Senator Richard C. Shelby Vice Chairman, Senate Select Committee on Intelligence
30. D.E. Shelton The 'CSI Effect': does it really exist? NIJ Journal 259 2008
31. R.L. Snow Technology and law enforcement: from gumshoe to gamma rays 2007 Greenwood Publishing Group
32. A. Tridgell, and P. Mackerras The rsync algorithm Technical Report TR-CS-96-05; ANU Computer Science Technical Reports 1996
33. US Supreme Court Bobbs-Merrill Co. v. Straus 1908 210 US 339
34. US Supreme Court California v. Greenwood 1988 486 US 35
35. Voncken G. Guymanager; 2012. http://guymager.sourceforge.net/.
36. R.J. Walls, E. Learned-Miller, and B.N. Levine Forensic triage for mobile phones with dec0de Proceedings of the 20th USENIX security symposium 2011 USENIX
37. R.J. Walls, B.N. Levine, M. Liberatore, and C. Shields Effective digital forensics research is investigator-centric Proc. USENIX workshop on Hot Topics in Security (HotSec) 2011
38. C. Wright, D. Kleiman, and R.S. Shyaam Sundhar Overwriting hard drive data: the great wiping controversy Lecture notes in computer science/ICISS 2008 2008 Springer 243 257