Full Text Hash-based Classification of Data: Class-based Similarity Hashing, IFIP 2008 Abstract In this paper, we introduce the notion of class-aware similarity hashes, or classprints which is an outgrowth of recent work on similarity hashing. Specifically, we build on the notion of context-based hashing to design a framework both for...
Full Text In-place File Carving, IFIP 2007 Abstract File carving is the process of recovering files from an investigative target, potentially without knowledge of the file system structures. The process is based on information about the format of the file types of interest, as well as on assumptions about how...
Full Text Massive Threading: Using GPUs to Increase the Performance of Digital Forensics Tools, DFRWS 2007 Abstract The current generation of Graphics Processing Units (GPUs) contain a large number of general purpose processors, in sharp contrast to previous generation designs, where special-purpose hardware units (such as texture and vertex shaders)...
Full Text Multi-Resolution Similarity Hashing, DFRWS 2007 Abstract Large-scale digital forensic investigations present at least two fundamental challenges. The first one is accommodating the computational needs of a large amount of data to be processed. The second one is extracting useful information from the raw data in an automated fashion....
Full Text Forensic discovery auditing of digital evidence containers, Journal of Digital Investigation 2007 Abstract Current digital forensics methods capture, preserve, and analyze digital evidence in generalpurpose electronic containers (typically, plain files)with no dedicated support to help establish that the evidence has been properly handled. Auditing of a digital investigation,...