Remembrance of data passed: a study of disk sanitization practices

Garfinkel, Simson L.; Shelat, Abhi

doi:10.1109/msecp.2003.1176992

Cited by 160 publications

(103 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…If this occurs, then it may be classified as live forensics. Digital evidence that may be lost, such as data stored on volatile memory modules [43], must also be included.• Examination is the phase during which the evidence is made visible. The origin and significance of the evidence is determined.…”

mentioning

confidence: 99%

See 1 more Smart Citation

Integrated digital forensic process model

Köhn¹,

Eloff²,

Eloff³

2013

Computers & Security

111

View full text Add to dashboard Cite

The Information and Communications Technology (ICT) environment constitutes an integral part of our daily lives. Individual computer users and large corporate companies are increasingly dependent on services provided by ICT. These services range from basic communication to managing large databases with corporate client information. Within these ICT environments something is bound to go wrong for a number of reasons, which include an intentional attack on information services provided by an organisation. These organisations have in turn become interested in tracing the root cause of such an incident with the intent of successfully prosecuting a suspected malicious user.Digital forensics has developed significantly towards prosecuting such criminals. The volumes of information and rapid technological developments have contributed to making simple investigations rather cumbersome. In the digital forensics community a number of digital forensic process models have been proposed encapsulating a complete methodology for an investigation. Software developers have also greatly contributed toward the development of digital forensics tools. These developments have resulted in divergent views on digital forensic investigations. This dissertation presents the IDFPM -Integrated Digital Forensic Process Model.The model is presented after examining digital forensic process models within the current academic and law enforcement literature. An adapted sequential logic notation is used to represent the forensic models. The terminology used in the various models is examined and standardised to suit the IDFPM. Finally, a prototype supports a limited selection of the IDFPM processes, which will aid a digital forensic investigator. There are a great many things about architecture that are hidden from the untrained eye.-Frank Gehry Acknowledgements• Thank you God for giving me the strength, wisdom, endurance and the patience to do this, despite the constant challenges.• I would like to thank my mother and father, Gary and Magsie, for their constant support, love and encouragement. Thank you for always listening and giving much needed advice. I would also like to thank my brothers Jonathan and Alexander, and sister Vanessa for their enthusiasm. None of this would have been possible without your support.• Thank you Prof Jan Eloff who has insisted that I complete this milestone in my life.Thank you for pushing me through the difficult times with your knowledge and experience. Thank you Prof Mariki Eloff for your soft and kind words that inspired me to see this through. You have both become great friends in this journey.• Thank you Prof Kourie, Prof Olivier, Prof Venter and Prof Carsten for listening when I asked questions, guiding me toward possible answers. Your help is highly appreciated.• My friends and colleagues in the ICSA lab over the past number of years. Thank you Emmanuel Adigun, Kamil Reddy, Maciej Rossudowski, Marco Slaviero, NeilCroft, Johann Fourie, Francois Mouton, Pedro de Souza and Waldo Delport. You have all tau...

show abstract

mentioning

confidence: 99%

“…If this occurs, then it may be classified as live forensics. Digital evidence that may be lost, such as data stored on volatile memory modules [43], must also be included.…”

mentioning

confidence: 99%

Integrated digital forensic process model

Köhn¹,

Eloff²,

Eloff³

2013

Computers & Security

111

View full text Add to dashboard Cite

show abstract

“…Encryption, as an element of cryptography, is a methodology for achieving information security, through secretive communications [14].…”

Section: A Data Encryption For Information Securitymentioning

confidence: 99%

Privacy Impacts of Data Encryption on the Efficiency of Digital Forensics Technology

Balogun¹,

Zhu²

2013

IJACSA

View full text Add to dashboard Cite

Abstract-Owing to a number of reasons, the deployment of encryption solutions are beginning to be ubiquitous at both organizational and individual levels. The most emphasized reason is the necessity to ensure confidentiality of privileged information. Unfortunately, it is also popular as cyber-criminals' escape route from the grasp of digital forensic investigations. The direct encryption of data or indirect encryption of storage devices, more often than not, prevents access to such information contained therein. This consequently leaves the forensics investigation team, and subsequently the prosecution, little or no evidence to work with, in sixty percent of such cases. However, it is unthinkable to jeopardize the successes brought by encryption technology to information security, in favour of digital forensics technology. This paper examines what data encryption contributes to information security, and then highlights its contributions to digital forensics of disk drives. The paper also discusses the available ways and tools, in digital forensics, to get around the problems constituted by encryption. A particular attention is paid to the Truecrypt encryption solution to illustrate ideas being discussed. It then compares encryption's contributions in both realms, to justify the need for introduction of new technologies to forensically defeat data encryption as the only solution, whilst maintaining the privacy goal of users.

show abstract

“…These may range from simply copying the user-accessible files within the file system, to recovery of overwritten or deleted data, to the assemblage of metadata and use of statistical methods to determine access profiles and identify users associated with particular data items [15].…”

Section: Disk Images As Digital Objectsmentioning

confidence: 99%

“…More frequently, it is necessary to provide only portions of the image. A variety of approaches both for creating views into the raw data and extracting relevant selections of files and information to be stored for future use have been discussed in the forensics literature [15]. In other approaches, selective access to partial contents of a disk image are generated as needed using a pre-computed index, minimizing storage overhead while supporting high-performance access and retrieval [33][34].…”

Section: Dissemination Approachesmentioning

confidence: 99%

Extending digital repository architectures to support disk image preservation and access

Woods

Lee

Garfinkel

2011

Proceedings of the 11th Annual International ACM/IEEE Joint Conference on Digital Libraries

View full text Add to dashboard Cite

Disk images (bitstreams extracted from physical media) can play an essential role in the acquisition and management of digital collections by serving as containers that support data integrity and chain of custody, while ensuring continued access to the underlying bits without depending on physical carriers. Widely used today by practitioners of digital forensics, disk images can serve as baselines for comparison for digital preservation activities, as they provide fail-safe mechanisms when curatorial actions make unexpected changes to data; enable access to potentially valuable data that resides below the file system level; and provide options for future analysis. We discuss established digital forensics techniques for acquiring, preserving and annotating disk images, provide examples from both research and educational collections, and describe specific forensic tools and techniques, including an object-oriented data packaging framework called the Advanced Forensic Format (AFF) and the Digital Forensics XML (DFXML) metadata representation.

show abstract

Remembrance of data passed: a study of disk sanitization practices

Cited by 160 publications

References 2 publications

Integrated digital forensic process model

Integrated digital forensic process model

Privacy Impacts of Data Encryption on the Efficiency of Digital Forensics Technology

Extending digital repository architectures to support disk image preservation and access

Contact Info

Product

Resources

About