MMR: A Platform for Large-Scale Forensic Computing

January 25, 2009

Full Text MMR: A Platform for Large-Scale Forensic Computing, IFIP 2009 Abstract The timely processing of large-scale digital forensic targets demands the empoyment of large-scale distributed resources, as well as the flexibility to customize the processing performed on the target. We presentMMR– a new, open implementation of the MapReduce processing...

Dynamic Recreation of Kernel Data Structures for Live Forensics

August 11, 2008

Full Text Dynamic Recreation of Kernel Data Structures for Live Forensics, DFRWS 2010 Abstract The role of live forensics in digital forensic investigations has become vital due to the importance of volatile data such as encryption keys, network activity, currently running processes, in memory only malware, and other key pieces...

Treasure and Tragedy in kmem_cache Mining for Live Forensics Investigation

August 11, 2008

Full Text Treasure and Tragedy in kmem_cache Mining for Live Forensics Investigation, DFRWS 2010 Abstract This paper presents the first deep investigation of the kmem_cache facility in Linux from a forensics perspective. The kmem_cache is used by the Linux kernel to quickly allocate and deallocate kernel structures associated with processes,...

FACE: Automated Digital Evidence Discovery and Correlation

August 11, 2008

Full Text FACE: Automated Digital Evidence Discovery and Correlation, DFRWS 2008 Abstract Digital forensic tools are being developed at a brisk pace in response to the ever increasing variety of forensic targets. Most tools are created for specific tasks–file system analysis, memory analysis, network analysis, etc.–and make little effort to...

Hash-based Classification of Data: Class-based Similarity Hashing

January 27, 2008

Full Text Hash-based Classification of Data: Class-based Similarity Hashing, IFIP 2008 Abstract In this paper, we introduce the notion of class-aware similarity hashes, or classprints which is an outgrowth of recent work on similarity hashing. Specifically, we build on the notion of context-based hashing to design a framework both for...

In-place File Carving

August 22, 2007

Full Text In-place File Carving, IFIP 2007 Abstract File carving is the process of recovering files from an investigative target, potentially without knowledge of the file system structures. The process is based on information about the format of the file types of interest, as well as on assumptions about how...

Multi-Resolution Similarity Hashing

August 13, 2007

Full Text Multi-Resolution Similarity Hashing, DFRWS 2007 Abstract Large-scale digital forensic investigations present at least two fundamental challenges. The first one is accommodating the computational needs of a large amount of data to be processed. The second one is extracting useful information from the raw data in an automated fashion....

Forensic discovery auditing of digital evidence containers

April 2, 2007

Full Text Forensic discovery auditing of digital evidence containers, Journal of Digital Investigation 2007 Abstract Current digital forensics methods capture, preserve, and analyze digital evidence in generalpurpose electronic containers (typically, plain files)with no dedicated support to help establish that the evidence has been properly handled. Auditing of a digital investigation,...