A general strategy for differential forensic analysis

Digital Investigation

Volumn 9, Issue SUPPL., 2012, Pages

  Garfinkel, Simson ^a   Nelson, Alex J ^b   Young, Joel ^a  

^a NAVAL POSTGRADUATE SCHOOL   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Differencing; Feature extraction; Forensic strategies; Forensics; Temporal analysis

Indexed keywords

FEATURE EXTRACTION;

DIFFERENCING; DIFFERENTIAL ANALYSIS; DIGITAL DOCUMENTS; FORENSIC ANALYSIS; FORENSIC STRATEGIES; FORENSICS; NETWORK BANDWIDTH; TEMPORAL ANALYSIS;

COMPUTER FORENSICS;

EID: 84864616626     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2012.05.003     Document Type: Conference Paper

References (38)

1. Access Data Forensic toolkit (FTK) 2011
2. T. Apiwattanapong, A. Orso, and M.J. Harrold A differencing algorithm for object-oriented programs Proceedings of the 19th IEEE international conference on automated software engineering 2004 IEEE Computer Society Washington, DC, USA 2 13 (Pubitemid 40423526)
3. Beverly R, Garfinkel S, Cardwell G. Forensic carving of network packets and associated data structures. In: Proceedings of the 2011 DFRWS conference; 2011. p. S78-89.
4. B. Carrier The Sleuth Kit and Kutopsy: forensics tools for Linux and other Unixes 2005
5. A. Duley, C. Spandikow, and M. Kim A program differencing algorithm for Verilog HDL Proceedings of the IEEE/ACM international conference on automated software engineering 2010 ACM New York, NY, USA 477 486 ASE '10
6. J. Elson, and S. Garfinkel tcpflow 2011
7. S. Garfinkel Digital Forensics XML Digital Investigation 8 2012 161 174
8. S. Garfinkel, A. Parker-Wood, D. Huynh, and J. Migletz A solution to the multi-user carved data ascription problem IEEE Transactions on Information Forensics and Security 5 4 2010 868 882
9. S. Garfinkel, and N. Rowe Global analysis of drive file times Fifth international workshop on systematic approaches to digital forensic engineering 2010 IEEE Oakland, CA 97 108
10. S.L. Garfinkel Automating disk forensic processing with SleuthKit, XML and Python Proceedings of the fourth international IEEE workshop on systematic approaches to digital forensic engineering 2009 IEEE Oakland, CA 73 84
11. S.L. Garfinkel, P. Farrell, V. Roussev, and G. Dinolt Bringing science to digital forensics with standardized forensic corpora Proceedings of the 9th annual digital forensic research workshop (DFRWS) 2009 Elsevier Quebec, CA
12. G. Grosenbach Git source code control 1st ed. 2007 PeepCode
13. Guidance Software, Inc EnCase Forensic 2011
14. S. Horwitz Identifying the semantic and textual differences between two versions of a program Proceedings of the ACM SIGPLAN 1990 conference on programming language design and implementation 1990 ACM New York, NY, USA 234 245 PLDI '90
15. J.W. Hunt, and M.D. McIlroy An algorithm for differential file comparison Technical report 41 1976 Bell Laboratories
16. J. Jacobson A formalization of Darcs patch theory using inverse semigroups Technical report CAM09-83 2009 UCLA
17. G.H. Kim, and E.H. Spafford The design and implementation of tripwire: a file system integrity checker Proceedings of the 2nd ACM conference on computer and communications security 1994 ACM New York, NY, USA 18 29 CCS '94
18. J. Kornblum md5deep and hashdeep - latest version 4.1.2011 http://md5deep.sourceforge.net/ [last accessed 18.02.12]
19. J. Levy Differential EnScript v1 2012
20. T. Lindholm, J. Kangasharju, and S. Tarkoma Fast and simple XML tree differencing by sequence alignment Proceedings of the 2006 ACM symposium on document engineering 2006 ACM New York, NY, USA 75 84 DocEng '06 (Pubitemid 46634243)
21. A. Loh, and M. Kim LSdiff: a program differencing tool to identify systematic structural differences Proceedings of the 32nd ACM/IEEE international conference on software engineering vol. 2 2010 ACM New York, NY, USA 263 266 ICSE '10
22. Marrington A, Baggili I, Mohay G, Clark A. CAT Detect (computer activity timeline detection): a tool for detecting inconsistency in computer activity timelines. In: Proceedings of the 2011 DFRWS conference; 2011. p. S52-61.
23. E. Myers An O(ND) difference algorithm and its variations Algorithmica 1 1986 251 266 (Pubitemid 17556676)
24. Nelson AJ. RegXML: XML conversion of the Windows registry for forensic processing and distribution. In: Chow KP, Shenoi S, editors. Advances in digital forensics VIII. Springer; IFIP Advances in Information and Communication Technology, in press.
25. NIST National Software Reference Library 2009 http://www.nsrl.nist.gov/ Documents/NSRL-CFS-April-2009.pdf
26. Olsson J, Boldt M. Computer forensic timeline visualization tool. In: Proceedings of the 2009 DFRWS conference; 2009. p. S78-87.
27. B.C. Pierce, and J. Vouillon What's in Unison? A formal specification and reference implementation of a file synchronizer Technical report 2004
28. C. Pilato, B. Collins-Sussman, and B. Fitzpatrick Version Control with Subversion 2nd ed. 2008 O'Reilly Media, Inc.
29. D. Roundy Darcs: distributed version management in Haskell Proceedings of the 2005 ACM SIGPLAN workshop on Haskell 2005 ACM New York, NY, USA 1 4 Haskell '05 (Pubitemid 43206655)
30. Schatz B, Mohay G, Clark A. A correlation method for establishing provenance of timestamps in digital evidence. In: Proceedings of the 2006 DFRWS conference; 2006. p. S98-107.
31. K. Thompson, and D.M. Ritchie diff - differential file comparator. UNIX programmer's manual 6th ed. 1975
32. W.F. Tichy Design, implementation, and evaluation of a revision control system Proceedings of the 6th international conference on software engineering 1982 IEEE Computer Society Press Los Alamitos, CA, USA 58 67 ICSE '82
33. A. Tridgell, and P. Mackerras The rsync algorithm Technical report TR-CS-96-05; ANU computer science technical reports 1996
34. Watkins K, McWhorter M, Long J, Hill W. Teleporter: an analytically and forensically sound duplicate transfer system. In: Proceedings of the 2009 DFRWS conference; 2009.
35. G.A. Weaver, N. Foti, S. Bratus, D. Rockmore, and S.W. Smith Using hierarchal change mining to manage network security policy evolution Proceedings of the 11th USENIX conference on hot topics in management of internet, cloud, and enterprise networks and services 2011 USENIX Association Berkeley, CA, USA 8 Hot-ICE'11
36. G.A. Weaver, and S.W. Smith Context-free grep and hierarchical diff LISA '11: 25th large installation system administration conference 2011 USENIX
37. D. White Tracking computer use with the windows registry dataset 2008
38. K. Woods, C. Lee, S. Garfinkel, D. Dittrich, A. Russell, and K. Kearton Creating realistic corpora for forensic and security education 2011 ADFSL conference on digital forensics, security and law 2011 Elsevier Richmond, VA