Protecting Digital Legal Professional Privilege (LPP) Data

Law, Frank Y. W.; Lai, P.K.Y.; Jiang, Zoe L.; Ieong, Ricci S. C.; Kwan, Mei Po; Chow, Kam-Pui; Hui, Lucas Chi Kwong; Yiu, Siu-Ming; Chong, C.F.

doi:10.1109/sadfe.2008.19

Cited by 5 publications

(7 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[11] tried to apply 3-D scheme to solve the LPP integrity problem. However, they assume that somehow the list of the sectors (files) to be claimed as LPP data may be known in order to create an additional hash chain on those affected sectors.…”

Section: Literature Reviewmentioning

confidence: 99%

“…The section first reviews the modified 3-D hashing scheme given in [11], then proposes the "Dual Cube" hashing scheme which can greatly enhance the performance of the integrity verification scheme by reducing the number of possibly affected sectors.…”

Section: Dual Cube Hashing Schemementioning

confidence: 99%

“…When it is applied to the digital world, it is possible that LPP data exists in a seized hard disk in A hard disk stores numerous files and information (including the logically deleted data). As indicated in [11], in practice, it is not feasible to let the owner delete all LPP data before the suspicious hard disk is being seized and cloned as it requires legal professionals to determine whether a piece of information can be possibly classified as LPP data. The investigator would also worry that the suspect may purposely erase some evidence which is actually non-LPP data.…”

mentioning

confidence: 99%

“…Ref. [11] proposed a procedure trying to satisfy the above requirements. Roughly speaking, the core steps of the procedure are as follow.…”

mentioning

confidence: 99%

See 3 more Smart Citations

A Dual Cube Hashing Scheme for Solving LPP Integrity Problem

Fang

Jiang

Yiu

et al. 2011

2011 Sixth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering

Self Cite

View full text Add to dashboard Cite

In digital forensics, data stored in a hard disk usually contains valuable evidence. Preserving the integrity of the data in the hard disk is a critical issue. A single hash value for the whole hard disk is not appropriate as the investigation may take a long time and latent sector errors (LSEs) (bad sectors due to media imperfection, for example) which cause a sector suddenly unreadable will make the hash value inconsistent. On the other hand, using a hash per sector may need to store a lot of hash values. Previous research has been conducted to use fewer hash values, but can resist some of LSEs to decrease the number of unverifiable sectors even if there are LSEs. This integrity problem is more complicated in the presence of Legal Professional Privileged (LPP) data inside a seized hard disk in digital forensic as the hard disk has to be cloned once seized and the original hard disk will be sealed after cloning. Hash values need to be computed during this cloning process. However, the cloned copy will be returned to the suspect for the deletion of LPP data before the investigator can work on the sanitized copy. Thus, the integrity of unmodified sectors has to be verified using the hash values computed based on the original hard disk. This paper found that existing schemes are not good enough to solve the integrity problem in the presence of both LSEs and deletion of LPP data. We then propose the idea of a "Dual Cube" hashing scheme to solve the problem. The experiments show the proposed scheme performs better than the previous schemes and fits easily into the digital forensic procedure.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Section: Dual Cube Hashing Schemementioning

confidence: 99%

mentioning

confidence: 99%

“…Ref. [11] proposed a procedure trying to satisfy the above requirements. Roughly speaking, the core steps of the procedure are as follow.…”

mentioning

confidence: 99%

See 2 more Smart Citations

A Dual Cube Hashing Scheme for Solving LPP Integrity Problem

Fang

Jiang

Yiu

et al. 2011

2011 Sixth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering

Self Cite

View full text Add to dashboard Cite

show abstract

“…In other cases when the suspect is allowed to modify or delete some of the sectors on his own (e.g. files classified as Legal Professional Privilege data [3]), we may try to see if the integrity of the evidence is not affected. So, the approach of storing one single chained hash value is less attractive.…”

Section: Introductionmentioning

confidence: 99%

Hard Disk Integrity Check by Hashing with Combinatorial Group Testing

Fang

Jiang

Yiu

et al. 2009

2009 2nd International Conference on Computer Science and Its Applications

Self Cite

View full text Add to dashboard Cite

In this paper, we describe the problem of verifying the integrity of a hard disk especially for forensics investigation after the computer of a suspect has been seized. Existing solutions do not provide a satisfactory solution to solve the problem. They either require a huge amount of storage to store the hash values of the sectors or may not be able to cope with the situation in an effective way in case some sectors have been modified (e.g. become bad sectors or deleted due to being part of the Legal Professional Privilege items). We introduce to use ThierryMieg[15]'s combinatorial group testing scheme, which seems to be an unrelated topic, to design a scheme to compute the hash values for the sectors of a hard disk. The storage for hash values in our scheme can be significantly fewer than the best existing solution while requiring similar amount of execution time. And our scheme can accurately point out the sectors which have been modified while existing solutions cannot guarantee this.

show abstract