Using purpose-built functions and block hashes to enable small block and sub-file forensics

DFRWS 2010 Annual Conference

Volumn 7, Issue , 2010, Pages

  Garfinkel, Simson ^a   Nelson, Alex ^a   White, Douglas ^a   Roussev, Vassil ^b  

^a Naval Postgraduate School   (United States)

^b USA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER FORENSICS;

COMPRESSED DATUM; CRYPTOGRAPHIC HASHES; FILE FRAGMENTS; RANDOM SAMPLING; SMALL DATA;

DIGITAL STORAGE;

EID: 84868552267     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (25)

1. Al-Dahir Omar, Hua Joseph, Marziale Lodovico, Nino Jaime, Richard III Golden G, Roussev Vassil. MP3 scalpel, http://sandbox.dfrws.org/2007/UNO/ executables-and-source/; 2007.
2. Andersen David G, Franklin Jason, Kaminsky Michael, Phanishayee Amar, Tan Lawrence, Vasudevan Vijay. FAWN: a fast array of wimpy nodes. In: SOSP '09: Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles, pp. 1-14. ACM, New York, NY, USA, 2009. ISBN 978-1-60558-752-3.
3. Bakker EM, Leeuwen J, Tan RB. Prefix routing schemes in dynamic networks. Computer Networks and ISDN Systems 1993;26(4): 403-21.
4. Calhoun William C, Coles Drue. Predicting the types of file fragments. In: Digital Investigation: The Proceedings of the Eighth Annual DFRWS Conference, vol. 5, 2008.
5. Collange Sylvain, Daumas Marc, Dandass Yoginder S, Defour David. Using graphics processors for parallelizing hash-based data carving, http://hal.archives-ouvertes.fr/docs/00/35/09/62/PDF/ColDanDauDef09.pdf; 2009.
6. Dandass Yoginder Singh, Necaise Nathan Joseph, Thomas Sherry Reede. An empirical analysis of disk sector hashes for data carving. Journal of Digital Forensic Practice 2008;2:95-104.
7. Darwin Ian F. Libmagic, ftp://ftp.astron.com/pub/file/; August 2008.
8. Deutsch LP, Gailly J-L. RFC 1950: ZLIB compressed data format specification version 3.3, May 1996. Status: INFORMATIONAL.
9. Devore Jay L. Probability and Statistics for Engineering and the Sciences. 5th ed. Duxbury; 2000.
10. Farrell Paul, Garfinkel Simson, White Doug. Practical applications of bloom filters to the nist rds and hard drive triage. In: Annual Computer Security Applications Conference 2008, December 2008.
11. Fonseca Brian. Hard-drive changes: Long block data standard gets green light. Computerworld, http://www.computerworld.com/action/article.do?articleID= 9018507; May 2007.
12. Garfinkel Simson L, Farrell Paul, Roussev Vassil, Dinolt George. Bringing science to digital forensics with standardized forensic corpora. In: Proceedings of the 9th Annual Digital Forensic Research Workshop (DFRWS), August 2009.
13. Garfinkel Simson L. Dfrws 2006 challenge report, http://sandbox.dfrws. org/2006/garfinkel/part1.txt; 2006a.
14. Garfinkel Simson L. Forensic feature extraction and cross-drive analysis. In: Proceedings of the 6th Annual Digital Forensic ResearchWorkshop (DFRWS). Elsevier, Lafayette, Indiana,August 2006b. http://www.dfrws.org/2006/ proceedings/10-Garfinkel.pdf.
15. Garfinkel Simson L. Carving contiguous and fragmented files with fast object validation. In: Proceedings of the 7th Annual Digital Forensic Research Workshop (DFRWS), August 2007.
16. Karresand Martin, Shahmehri Nahid. Oscardfile type identiïcation of binary data in disk clusters and ram pages. In: Annual Workshop on Digital Forensics and Incident Analysis, pp. 85-94. Springer-Verlag, 2006.
17. Li WJ, Wang K, Stolfo SJ, Herzog B. Fileprints: identifying file types by n-gram analysis. In: 6th IEEE Informaton Assurance Workshop, June 2005.
18. McDaniel Mason. Automatic file type detection algorithm. Master's thesis, James Madison University, 2001.
19. Moody Sarah J, Erbacher Robert F. Sadi: Statistical analysis for data type identification. In: May 2008. Proceedings of the 3rd IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, pp. 41-54, May 2008.
20. National Institute of Standards and Technology. National software reference library reference data set, http://www.nsrl.nist.gov/; 2005 [Online; Accessed 06.03.09].
21. Zweig MH, Campbell G. Receiver-operating characteristic (roc) plots: a fundamental evaluation tool in clinical medicine. Clin Chem 1993;39:561-77. (Pubitemid 23118304)
22. Roussev Vassil, Garfinkel Simson. File fragment classification-the case for specialized approaches. In: Systematic Approaches to Digital Forensics Engineering (IEEE/ SADFE 2009). Springer, May 2009.
23. Richard III Golden G, Scalpel Roussev V. A frugal, high performance file carver. In: Proceedings of the 2005 Digital Forensics Research Workshop. DFRWS, August 2005. http://www.digitalforensicssolutions.com/Scalpel/.
24. Speirs II William R, Cole Eric B. US patent application 20070116267, methods for categorizing input data, May 2007.
25. Veenman CJ. Statistical disk cluster classification for file carving. In: Proceedings of the First International Workshop on Computational Forensics, August 31 2007.