On the role of file system metadata in digital forensics

Buchholz, Florian; Spafford, Eugene H.

doi:10.1016/j.diin.2004.10.002

Cited by 68 publications

(34 citation statements)

References 10 publications

(10 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In previous work [8] we have discussed desired information from a forensic investigator's point of view. For a typical home computer none of the extra information may be worth the space requirements or restrictions that would result from recording it.…”

Section: Discussionmentioning

confidence: 99%

“…To show that the label propagation also works well with non-custom programs, we also tested the location information case study as described in previous work [8].…”

Section: Location Informationmentioning

confidence: 99%

“…These two categories are user influence and location information (host causality [7]). The need for this kind of information and other categories is discussed in previous work [8].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Run-time label propagation for forensic audit data

Buchholz

Spafford

2007

Computers & Security

Self Cite

View full text Add to dashboard Cite

It is desirable to be able to gather more forensically valuable audit data from computing systems than is currently done or possible. This is useful for the reconstruction of events that took place on the system for the purpose of digital forensic investigations. In this paper, we propose a mechanism that allows arbitrary meta-information bound to principals on a system to be propagated based on causality influenced by information flow. We further discuss how to implement such a mechanism for the FreeBSD operating system and present a proof-of-concept implementation that has little overhead compared to the system without label propagation.

show abstract

Section: Discussionmentioning

confidence: 99%

“…To show that the label propagation also works well with non-custom programs, we also tested the location information case study as described in previous work [8].…”

Section: Location Informationmentioning

confidence: 99%

See 1 more Smart Citation

Run-time label propagation for forensic audit data

Buchholz

Spafford

2007

Computers & Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…According to Carrier and Spafford, every digital object which is a discrete collection of digital data, is an evidence of at least one event and the metadata is a partial representation of the state of a digital object. Buchholz and Spafford [28] have examined the role of file system metadata in digital investigations and they note that despite the lack of quality and quantity of information stored in file system metadata, it plays a crucial role in reconstructing events.…”

Section: "Metadata Includes Information About the Document Or File Thmentioning

confidence: 99%

Digital forensic research: current state of the art

Raghavan

2012

CSIT

112

View full text Add to dashboard Cite

Abstract-Digital Forensics is the process of employing scientific principles and processes analyze electronically stored information to determine the sequence of events which led to a particular incident. In this digital age, it is important for researchers to become aware of the recent developments in this dynamic field and understand scope for the future. The past decade has witnessed significant technological advancements to aid during a digital investigation. Many methodologies, tools and techniques have found their way into the field designed on forensic principles. Digital forensics has also witnessed many innovative approaches that have been explored to acquire and analyze digital evidence from diverse sources. In this paper, we review the research literature since 2000 and categorize developments in the field into 4 major categories. In recent years the exponential growth of technological has also brought with it some serious challenges for digital forensic research which is elucidated. Within each category, research is sub-classified into conceptual and practical advancements. We highlight the observations made by previous researchers and summarize the research directions for the future.

show abstract

“…The experiments we conducted used only hash values for files plus the directory metadata of file systems since much can be learned about a drive quickly from this alone (Buchholz and Spafford, 2004). Experiments were conducted on directory information of 2337 drive images from the Real Drive Corpus (RDC) (Garfinkel et al, 2009) as of April 2012.…”

Section: Setup Of a Corpus For Testingmentioning

confidence: 99%

Testing the National Software Reference Library

Rowe

2012

Digital Investigation

View full text Add to dashboard Cite

The National Software Reference Library (NSRL) is an essential data source for forensic investigators, providing in its Reference Data Set (RDS) a set of hash values of known software. However, the NSRL RDS has not previously been tested against a broad spectrum of real-world data. The current work did this using a corpus of 36 million files on 2337 drives from 21 countries. These experiments answered a number of important questions about the NSRL RDS, including what fraction of files it recognizes of different types. NSRL coverage by vendor/product was also tested, finding 51% of the vendor/product names in our corpus had no hash values at all in NSRL. It is shown that coverage or "recall" of the NSRL can be improved with additions from our corpus such as frequently-occurring files and files whose paths were found previously in NSRL with a different hash value. This provided 937,570 new hash values which should be uncontroversial additions to NSRL. Several additional tests investigated the accuracy of the NSRL data. Experiments testing the hash values saw no evidence of errors. Tests of file sizes showed them to be consistent except for a few cases. On the other hand, the product types assigned by NSRL can be disputed, and it failed to recognize any of a sample of virus-infected files. The file names provided by NSRL had numerous discrepancies with the file names found in the corpus, so the discrepancies were categorized; among other things, there were apparent spelling and punctuation errors. Some file names suggest that NSRL hash values were computed on deleted files, not a safe practice. The tests had the secondary benefit of helping identify occasional errors in the metadata obtained from drive imaging on deleted files in our corpus. This research has provided much data useful in improving NSRL and the forensic tools that depend upon it. It also provides a general methodology and software for testing hash sets against corpora.

show abstract

On the role of file system metadata in digital forensics

Cited by 68 publications

References 10 publications

Run-time label propagation for forensic audit data

Run-time label propagation for forensic audit data

Digital forensic research: current state of the art

Testing the National Software Reference Library

Contact Info

Product

Resources

About