Fast contraband detection in large capacity disk drives

Penrose, Philip; Buchanan, William J.; Macfarlane, Richard

doi:10.1016/j.diin.2015.01.007

Cited by 11 publications

(9 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Rather than focusing on processing large volumes of data in a timely fashion, Penrose et al [15] reduce the quantities of data to process by sampling small blocks from the storage media, while maximising sequential throughput from the device. Traditional cryptographic hashing is applied at the block level, with bloom filter look ups being used to detect fragments identified from known contraband.…”

Section: B Digital Forensic Triagementioning

confidence: 99%

Sub-file Hashing Strategies for Fast Contraband Detection

McKeown

Russell

Leimich

2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

Traditional digital forensics processes do not scale well with the huge quantities of data present in a modern investigation, resulting in large investigative backlogs for many law enforcement agencies. Data reduction techniques are required for fast and effective digital forensics triage, and to reduce the time taken to conduct an investigation. This work explores the potential of sub-file cryptographic hashing strategies, where small fragments of files are hashed in lieu of processing the file in its entirety, for contraband detection. Results show that subfile hashing techniques perform well, particularly on solid state media, while also retaining a high degree of discriminating power. Such strategies may offer an opportunity to take advantage of the performance characteristics of non-mechanical media, streamlining future investigations and greatly reducing investigation times.

show abstract

Section: B Digital Forensic Triagementioning

confidence: 99%

Sub-file Hashing Strategies for Fast Contraband Detection

McKeown

Russell

Leimich

2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

show abstract

“…Rather than parsing file system metadata to select data subsets, Penrose et al [16] uses statistical block sampling and traditional cryptographic hashing to detect contraband files at the block level, ordering disk reads for maximal throughput. By selecting an appropriate sample size for the target media, this approach generates fast results with high levels of statistical confidence.…”

Section: Related Work a Detecting Contrabandmentioning

confidence: 99%

Reducing the Impact of Network Bottlenecks on Remote Contraband Detection

McKeown

Russell

Leimich

2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

Cloud based storage is increasing in popularity, with large volumes of data being stored remotely. Digital forensics investigators examining such systems remotely are limited by bandwidth constraints when accessing this kind of data using traditional tools. This paper explores the potential for sub-file hashing strategies to decrease the time taken to detect contraband on networked storage devices, while maintaining a high degree of accuracy. Results show that sub-file hashing is faster than full file hashing for both LAN and Internet server configurations, with reduced bandwidth heavily favouring sub-file strategies.

show abstract

“…An extension to this methodology is to provide remote access to suspect devices to digital forensic experts to enable time sensitive analysis and investigation. Fast detection of pertinent evidence can prove crucial to the timely progression of a number of investigation [5]. [7] proposed a formalised process model for the conducting of computer forensics field triage -pushing some of the traditional forensic laboratory investigative steps to the field.…”

Section: Related Work a Expediting The Digital Forensic Processmentioning

confidence: 99%

Towards the Leveraging of Data Deduplication to Break the Disk Acquisition Speed Limit

Wolahan¹,

Lorenzo²,

Bou‐Harb

et al. 2016

2016 8th IFIP International Conference on New Technologies, Mobility and Security (NTMS)

View full text Add to dashboard Cite

Digital forensic evidence acquisition speed is traditionally limited by two main factors: the read speed of the storage device being investigated, i.e., the read speed of the disk, memory, remote storage, mobile device, etc.), and the write speed of the system used for storing the acquired data. Digital forensic investigators can somewhat mitigate the latter issue through the use of high-speed storage options, such as networked RAID storage, in the controlled environment of the forensic laboratory. However, traditionally, little can be done to improve the acquisition speed past its physical read speed from the target device itself. The protracted time taken for data acquisition wastes digital forensic experts' time, contributes to digital forensic investigation backlogs worldwide, and delays pertinent information from potentially influencing the direction of an investigation. In a remote acquisition scenario, a third contributing factor can also become a detriment to the overall acquisition time -typically the Internet upload speed of the acquisition system. This paper explores an alternative to the traditional evidence acquisition model through the leveraging of a forensic data deduplication system. The advantages that a deduplicated approach can provide over the current digital forensic evidence acquisition process are outlined and some preliminary results of a prototype implementation are discussed.

show abstract

Fast contraband detection in large capacity disk drives

Cited by 11 publications

References 16 publications

Sub-file Hashing Strategies for Fast Contraband Detection

Sub-file Hashing Strategies for Fast Contraband Detection

Reducing the Impact of Network Bottlenecks on Remote Contraband Detection

Towards the Leveraging of Data Deduplication to Break the Disk Acquisition Speed Limit

Contact Info

Product

Resources

About