Significant data region identification and analysis using k‐means in large storage drive forensics

Abstract

The recent technological advancement with less implementation cost has completely changed the scenario of information being generated, stored, or manipulated digitally by using the storage devices. Today the criminal activities are directly or indirectly associated with the storage devices, thus it is now recognized as an essential evidence in court-of-law throughout the world. However, the massive capacities of modern storage devices significantly increase the time and effort required to preserve and analyze the evidence. This paper proposes a methodology based on the random sector sampling and k-means clustering approaches to efficiently identify and evaluate the significant data regions instead of the entire storage drive. The random sampling and clustering methods efficiently reveal the unseen resident data pattern and intelligence about the regions of the drive which may be of investigator's interest. Experiments involving storage drives of various capacities demonstrate the efficacy of the methodology. Moreover, we generalize our discussion to represent that the extracted hidden patterns of storage drive data can assist an investigator in achieving the desired performance requirements. KEYWORDS k-means clustering, large storage drives, random sector sampling, selective examination, significant regions identification, storage drive forensics, stored data pattern 1 Security Privacy. 2018;1:e40.wileyonlinelibrary.com/journal/spy2

Resident Data Pattern Analysis Using Sector Clustering for Storage Drive Forensics

“…Randomly-selected sectors are easily classified as null or non-null sectors based on their content [4]. In this work, the entropy metric is used to identify sectors with human-readable, multimedia (images, audio and video), encoded, compressed, encrypted or executable content.…”

An intelligent approach for examining and detecting target data fragments in suspected large storage drives

“…Their approach was to divide the drive into the equal sized region and evaluate a specified number of samples independently from each region for detecting the desired artifacts, without employing structural information of the drive. In another work, Bharadwaj and Singh provided a method to segregate the significant and nonsignifcant regions of the drive using random sector sampling method and a simple two cluster K‐means algorithm. Their method also provide the resident data pattern of the drive on the basis of the feature metrics related to the randomly selected null and non‐null sectors.…”