High-Speed Searching Target Data Traces Based on Statistical Sampling for Digital Forensics

Doowon Jeong, Sangjin Lee

    Research output: Contribution to journalArticlepeer-review

    4 Citations (Scopus)

    Abstract

    As technology of manufacturing storage medium advances, data storage capacity has been increasing exponentially. This pervasiveness has made a forensic examination time-consuming and difficult. If a file system of data storage remains intact, an examiner can find files that would be important evidence by analyzing hierarchy, name, time information, etc. of files and folders. However, as anti-forensic techniques such as metadata destruction and disk format are widely known, the data search based on the file system becomes more impractical. Besides, significant evidences could be stored in the unallocated area; investigating the entire area of data storage is still important. The famous methods of exploring the existence of evidence are hash comparison and random sampling. The hash comparison that calculates hash for all sectors and compares them can detect all fragments of the evidence. However, it requires an enormous amount of time and computing resources. Whereas the random sampling takes much less time as it exploits a portion of data storage, but it involves the risk of false-negative; this fact is critical to forensic examiners. In this paper, we blend the merits of both methods to make false-negative zero and to reduce the processing time extremely at the same time. We use 16-byte values in a sector instead of traditional hash to filter out the unmatched sector. The values are statistically selected based on the frequency of occurrence according to offset. The effectiveness of our methodology is evaluated through several experiments.

    Original languageEnglish
    Article number8917643
    Pages (from-to)172264-172276
    Number of pages13
    JournalIEEE Access
    Volume7
    DOIs
    Publication statusPublished - 2019

    Bibliographical note

    Funding Information:
    This work was supported by the Institute of Information and Communications Technology Planning and Evaluation (IITP) grant funded by the Korea Government (MSIT) (No. 2018-0-01000, Development of Digital Forensic Integration Platform).

    Publisher Copyright:
    © 2013 IEEE.

    Keywords

    • Forensics
    • computer crime
    • data acquisition
    • security

    ASJC Scopus subject areas

    • General Computer Science
    • General Materials Science
    • General Engineering

    Fingerprint

    Dive into the research topics of 'High-Speed Searching Target Data Traces Based on Statistical Sampling for Digital Forensics'. Together they form a unique fingerprint.

    Cite this