Evaluation of a Sector-Hash Based Rapid File Detection Method for Monitoring Infrastructure-as-a-Service Cloud Platforms

Hirano, Manabu; Takase, Hayate; Yoshida, Kazuo

doi:10.1109/ares.2015.15

Cited by 5 publications

(2 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The notable factor is that TP of random sampling is lower and FN of the same method is dramatically higher than the other methods; this is bound to be the algorithm characteristics. Specifically, any fragment of docx file was not detected as this results from the characteristics of how the file is stored in the medium [36]. Generally, data are saved in the consecutive sector when the file is stored in the data storage.…”

Section: Results -Accuracymentioning

confidence: 99%

“…The existence of false-negative is a more critical factor in forensic investigation. As Hirano et al [36] evaluated the random sample's effectiveness experimentally, the method cannot find files less than 720 bytes on Windows OS. The evidence may never be found anymore if the evidence cannot be detected although the target was in the storage media.…”

Section: ) Random Samplingmentioning

confidence: 99%

See 1 more Smart Citation

High-Speed Searching Target Data Traces Based on Statistical Sampling for Digital Forensics

Jeong

Lee

2019

IEEE Access

View full text Add to dashboard Cite

As technology of manufacturing storage medium advances, data storage capacity has been increasing exponentially. This pervasiveness has made a forensic examination time-consuming and difficult. If a file system of data storage remains intact, an examiner can find files that would be important evidence by analyzing hierarchy, name, time information, etc. of files and folders. However, as anti-forensic techniques such as metadata destruction and disk format are widely known, the data search based on the file system becomes more impractical. Besides, significant evidences could be stored in the unallocated area; investigating the entire area of data storage is still important. The famous methods of exploring the existence of evidence are hash comparison and random sampling. The hash comparison that calculates hash for all sectors and compares them can detect all fragments of the evidence. However, it requires an enormous amount of time and computing resources. Whereas the random sampling takes much less time as it exploits a portion of data storage, but it involves the risk of false-negative; this fact is critical to forensic examiners. In this paper, we blend the merits of both methods to make false-negative zero and to reduce the processing time extremely at the same time. We use 16-byte values in a sector instead of traditional hash to filter out the unmatched sector. The values are statistically selected based on the frequency of occurrence according to offset. The effectiveness of our methodology is evaluated through several experiments. INDEX TERMS Forensics, computer crime, security, data acquisition.

show abstract

Section: Results -Accuracymentioning

confidence: 99%

Section: ) Random Samplingmentioning

confidence: 99%