Automatic Creation of Computer Forensic Test Images

Visti, Hannu; Tohill, Sean; Douglas, Paul

doi:10.1007/978-3-319-20125-2_14

Cited by 5 publications

(3 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Moch et al [10,11] have developed the Forensic Image Gener-ator Generator (Forensig2) that generates filesystem images for digital forensics training courses. Another similar tool is ForGe -Forensic Test Image Generator [18]. Yet another similar system is EviPlant [17], which facilitates the efficient creation, manipulation, storage and distribution of digital forensic challenge problems for education and training purposes.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A Novel Approach for Generating Synthetic Datasets for Digital Forensics

Göbel¹,

Schäfer²,

Hachenberger³

et al. 2020

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Increases in the quantity and complexity of digital evidence necessitate the development and application of advanced, accurate and efficient digital forensic tools. Digital forensic tool testing helps assure the veracity of digital evidence, but it requires appropriate validation datasets. The datasets are crucial to evaluating reproducibility and improving the state of the art. Datasets can be real-world or synthetic. While real-world datasets have the advantage of relevance, the interpretation of results can be difficult because reliable ground truth may not exist. In contrast, ground truth is easily established for synthetic datasets.This chapter presents the hystck framework for generating synthetic datasets with ground truth. The framework supports the automated generation of synthetic network traffic and operating system and application artifacts by simulating human-computer interactions. The generated data can be indistinguishable from data generated by normal human-computer interactions. The modular structure of the framework enhances the ability to incorporate extensions that simulate new applications and generate new types of network traffic.

show abstract

Section: Related Workmentioning

confidence: 99%

“…In addition to network traffic, the framework can be used to generate persistent disk images as in [10,11,17,18]. Depending on the user interaction model, the framework can partially automate forensic image generation, including background data and planted evidence.…”

Section: Disk Image Generatormentioning

confidence: 99%

A Novel Approach for Generating Synthetic Datasets for Digital Forensics

Göbel¹,

Schäfer²,

Hachenberger³

et al. 2020

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

show abstract

“…Another automated image creation tool is ForGe (Visti et al, 2015). This also allows a user to set up a scenario, including random elements, which results in the generation of an NTFS disk image.…”

Section: Current Approaches To Providing Viable Disk Imagesmentioning

confidence: 99%

EviPlant: An efficient digital forensic challenge creation, manipulation and distribution solution

Scanlon

Lillis

2017

Digital Investigation

View full text Add to dashboard Cite

a b s t r a c tEducation and training in digital forensics requires a variety of suitable challenge corpora containing realistic features including regular wear-and-tear, background noise, and the actual digital traces to be discovered during investigation. Typically, the creation of these challenges requires overly arduous effort on the part of the educator to ensure their viability. Once created, the challenge image needs to be stored and distributed to a class for practical training. This storage and distribution step requires significant time and resources and may not even be possible in an online/distance learning scenario due to the data sizes involved. As part of this paper, we introduce a more capable methodology and system as an alternative to current approaches. EviPlant is a system designed for the efficient creation, manipulation, storage and distribution of challenges for digital forensics education and training. The system relies on the initial distribution of base disk images, i.e., images containing solely base operating systems. In order to create challenges for students, educators can boot the base system, emulate the desired activity and perform a "diffing" of resultant image and the base image. This diffing process extracts the modified artefacts and associated metadata and stores them in an "evidence package". Evidence packages can be created for different personae, different wear-and-tear, different emulated crimes, etc., and multiple evidence packages can be distributed to students and integrated into the base images. A number of additional applications in digital forensic challenge creation for tool testing and validation, proficiency testing, and malware analysis are also discussed as a result of using EviPlant.

show abstract