Extending the Advanced Forensic Format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow

DFRWS 2009 Annual Conference

Volumn 6, Issue , 2009, Pages

  Cohen, Michael ^a   Garfinkel, Simson ^a   Schatz, Bradley ^a  

^a Australian Federal Police   (Australia)

Author keywords

Cryptography; Digital evidence management; Digital forensics; Distributed forensic analysis; Distributed storage; Evidence archiving; Forensic file format; Forensic integrity; Hard disk imaging; Image

Indexed keywords

COMPUTER CRIME; CRYPTOGRAPHY; DIGITAL FORENSICS; DIGITAL IMAGE STORAGE; ELECTRONIC CRIME COUNTERMEASURES; HARD DISK STORAGE; IMAGE ANALYSIS; SPECIFICATIONS;

DIGITAL EVIDENCE; DISK IMAGING; DISTRIBUTED STORAGE; EVIDENCE ARCHIVING; FILE FORMATS; FORENSIC ANALYSIS; FORENSIC INTEGRITY; IMAGE;

COMPUTER FORENSICS;

EID: 84868581192     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (23)

1. B.S. NTI Forensics Source. Safeback bit stream backup software [Online]. Available: http://www.forensics-intl.com/safeback.html; 2008.
2. Berners-Lee T, Masinter L, McCahill M. RFC 1738: uniform resource locators (URL), Dec. 1994, updated by RFC1808, RFC2368 [23][24]. Status: PROPOSED STANDARD.
3. Carrier BD, Spafford EH. "An event-based digital forensic investigation framework", in digital forensics research workshop [Online]. Available: http://www.digital-evidence.org/papers/dfrws-event.pdf; 2004.
4. Cohen M. Advanced carving techniques. Digital Investigation 2007;4(3-4):119-28. (Pubitemid 351381020)
5. Cohen MI. Pyflag: an advanced network forensic framework [Online]. Available:. In: Proceedings of the 2008 digital forensics research workshop. DFRWS http://www.pyflag.org; Aug. 2008.
6. Cohen MI. Advanced jpeg carving. In: e-Forensics '08: proceedings of the 1st international conference on forensic applications and techniques in telecommunications, information, and multimedia and workshop. ICST, Brussels, Belgium, Belgium: ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering); 2008. p. 1-6.
7. Cohen M. How to load a raid set into pyflag [Online]. Available: http://www.pyflag.net/cgi-bin/moin.cgi/RaidHowTo; 2008.
8. Fielding R, RFC 1808: Relative uniform resource locators, Jun. 1995, updates RFC1738 [13]. Updated by RFC2368 [24]. Status: PROPOSED STANDARD.
9. Fielding R, Gettys J, Mogul J, Frystyk H, Masinter L. RFC 2616: hypertext transfer protocol - HTTP/1.1 [Online]. Available: http://www.w3.org/Protocols/ rfc2616/rfc2616.html; June 1999.
10. Garfinkel SL. Providing cryptographic security and evidentiary chain-of-custody with the advanced forensic format, library, and tools. The International Journal of Digital Crime and Forensics 2009;1.
11. Garfinkel SL, Malan DJ, Dubec K-A, Stevens CC, Pham C. Disk imaging with the advanced forensic format, library and tools. In: Research advances in digital forensics (second annual IFIP WG 11.9 international conference on digital forensics). Springer; Jan. 2006.
12. Goland Y, Faizi EWA, Carter S, Jensen D. RFC 2518: HTTP extensions for distributed authoring - WEBDAV [Online]. Available: http://www.ietf.org/rfc/ rfc2518.txt; February 1999.
13. Guidance Software, Inc. EnCase forensic [Online]. Available: http://www.guidancesoftware.com/products/ef-index.asp; 2007.
14. Hoffman P, Masinter L, Zawinski J, RFC 2368: the mailto URL scheme, Jul. 1998, updates RFC1738, RFC1808 [13], [23]. Status: PROPOSED STANDARD. Ilook investigator [Online]. Available: http://ilook-forensics.org; 2008.
15. Katz P. APPNOTE.TXT d .ZIP file format specification [Online]. Available:. PKWare, Inc., Tech. Rep. http://www.pkware.com/documents/ casestudies/APPNOTE.TXT; Sep. 28 2007.
16. Keightley R. EnCase version 3.0 manual revision 3.18 [Online]. Available: http://www.guidancesoftware.com; 2003.
17. Kloet B, Metz J, Mora R-J, Loveall D, Schreiber D. libewf: project info [Online]. Available: http://www.uitwisselplatform.nl/projects/libewf; 2008.
18. Leach P, Mealling M, Salz R. RFC 4122: a universally unique identifier (UUID) URN namespace. standards Track. [Online]. Available: http://www.ietf.org/ rfc/rfc4122.txt; Jul. 2005.
19. Schatz BL, Clark A, An information architecture for digital evidence integration, In: Australian security response team annual conference; 2006.
20. Sollins K, Masinter L, RFC 1737: Functional requirements for uniform resource names, Dec. 1994, status: INFORMATIONAL.
21. Tanenbaum AS. Modern operating systems. Prentice Hall; 2008.
22. Various. libcurl - the multiprotocol file transfer library [Online]. Available: http://curl.haxx.se/libcurl; March 2009.
23. Zero storage carving; Nov. 2006.