Detecting data theft using stochastic forensics

DFRWS 2011 Annual Conference

Volumn 8, Issue , 2011, Pages

  Grier, Jonathan ^a  

^a Vesaria LLC   (United States)

Author keywords

Data breach; Data exfiltration; Data theft; Filesystem forensics; Forensics of emergent properties; MAC times; Stochastic forensics

Indexed keywords

CRIME; FILE ORGANIZATION; STOCHASTIC SYSTEMS;

DATA BREACH; DATA EXFILTRATION; DATA THEFTS; EMERGENT PROPERTY; FILESYSTEM; MAC TIMES; STOCHASTIC FORENSICS;

DIGITAL FORENSICS;

EID: 84868568568     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (24)

1. Carvey Harlan. Windows forensic analysis DVD Toolkit. 2nd ed. Syngress Publishing; 2009.
2. Carvey Harlan, Altheide Cory. Tracking USB storage: analysis of windows artifacts generated by USB storage devices. Digital Invest 2005;2(2):94-100.
3. Casey Eoghan. Digital evidence and computer crime. Orlando, FL, USA: Academic Press, Inc.; 2004.
4. Chow KP, Law Frank YW, Kwan Michael YK, Lai Pierre K Y. The Rules of time on NTFS file system. Pages 71-85 of: SADFE '07. In: Proceedings of the second international workshop on systematic approaches to digital forensic engineering. Washington, DC, USA: IEEE Computer Society; 2007. (Pubitemid 47298632)
5. CSI andFBI. 2003 computer crimeandsecurity survey.TechRept 2003. Farmer Dan. What are MACtimes? Dr Dobb's J Software Tools 2000; 25 (10):70-4. 68.
6. Farmer Dan, Venema Wietse. Forensic discovery. Addison Wesley Professional; 2004.
7. Ferguson Michael. File system numbers, http://www.cs.cornell.edu/courses/ cs614/2002sp/Fileppt; 2002 [accessed 03.09.10].
8. Free Software Foundation Inc.. GNU coreutils implementation, http://ftp.gnu.org/gnu/coreutils/coreutils-8.4.tar.gz; 2010 [accessed 03.09.10].
9. Garfinkel Simson, Farrell Paul, Roussev Vassil, Dinolt George. Bringing science to digital forensics with standardized forensic corpora. In: Proc. 9th annual digital forensic research workshop (DFRWS); 2009. August.
10. Gribble Steven D, Manku Gurmeet Singh, Roselli Drew, Brewer Eric A, Gibson Timothy J, Miller Ethan L. Self-similarity in file systems. SIGMETRICS Perform. Eval Rev 1998;26(1):141-50. (Pubitemid 128593230)
11. Hillstrom Kevin, Hillstrom Laurie Collier. Employee theft. In: Hillstrom Kevin, Hillstrom Laurie Collier, editors. Gale encyclopedia of small business. 2nd ed. Farmington Hills, MI, USA: Gale Group/Thomson Learning; 2002.
12. Kiriaty Yochay. Understanding windows 7 libraries, http:// windowsteamblog.com/blogs/developers/archive/2009/04/06/understanding-windows-7- libraries.aspx; 2009 [accessed 03. 09.10].
13. Liu Yali, Corbett Cherita, Chiang Ken, Archibald Rennie, Mukherjee Biswanath, Ghosal Dipak. SIDD: a framework for detecting sensitive data exfiltration by an insider attack. Hawaii Int Conf Syst Sci 2009;0:1-10.
14. Microsoft Corporation. Windows server 2003 Resource Kit Registry Reference: NtfsDisableLastAccessUpdate, http://technet.microsoft.com/en-us/ library/cc758569(ws.10).aspx;2003a [accessed 03.09.10].
15. Microsoft Corporation. Windows server 2003 technical Reference: how NTFS Works, http://technet.microsoft.com/en-us/library/cc781134(ws1.0).aspx; 2003b [accessed 03.09.10].
16. Microsoft Corporation. Microsoft Developer network online documentation: copyfile Function, http://msdn.microsoft.com/en-us/library/aa363851(VS.85).aspx; 2010a [accessed 03. 09.10].
17. Microsoft Corporation. Microsoft developer network: windows search overview, http://msdn.microsoft.com/en-us/library/aa965362(v=vs.85).aspx; 2010b [accessed 04.10.11].
18. Microsoft Corporation. Windows Developer Center: learn about windows 7: libraries, http://msdn.microsoft.com/en-us/windows/e-65582590.aspx; 2010c [accessed 03.09.10].
19. Sun Microsystems Inc.. Solaris mv command implementation, http://src.opensolaris.org/sourse/xref/onnv/onnv-gate/usr/src/cmd/mv/mv.c; 2009a [accessed 03.09.10].
20. Sun Microsystems Inc.. Solaris writefile implementation, http://src.opensolaris.org/sourse/xref/onnv/onnv-gate/usr/src/lib/libcmdutils/ common.writefile.c; 2009b [accessed 03.09.10].
21. Venema Wietse. File recovery techniques. Dr Dobb's J Software Tools 2000;25(12):76-80. 74.
22. Vogels, Werner. 1999. File system usage in Windows NT 4.0. Pages 93-109 of: SOSP '99: Proceedings of the seventeenth ACM symposium on Operating systems principles. New York, NY, USA: ACM.
23. Wikipedia. Pareto distribution, http://en.wikipedia.org/wiki/Pareto- distribution; 2010 [accessed 03.09.10].
24. Yu Yang, Chiueh Tzi-cker. Display-only file server: a solution against information theft due to insider attack. In: Proceedings of the 4th ACM workshop on digital rights management. DRM '04. New York, NY, USA: ACM; 2004.