Bringing science to digital forensics with standardized forensic corpora

Garfinkel, Simson L.; Farrell, Paul; Roussev, Vassil; Dinolt, George W.

doi:10.1016/j.diin.2009.06.016

Cited by 304 publications

(173 citation statements)

References 4 publications

Supporting

Mentioning

159

Contrasting

Unclassified

Order By: Relevance

“…Since much of the research is developed on customized operating platforms, using a particular case study developed by one group to cross validate has not been very successful. Garfinkel [77] acknowledges this absence and has called for conscious efforts on the part of researchers to develop extensive datasets and contribute to the community through various channels. Garfinkel and his group at the Naval Postgraduate School have since developed the Digital Corpora 13 which is available to academics on request.…”

Section: Indexing and Querying Digital Evidencementioning

confidence: 99%

Digital forensic research: current state of the art

Raghavan

2012

CSIT

115

View full text Add to dashboard Cite

Abstract-Digital Forensics is the process of employing scientific principles and processes analyze electronically stored information to determine the sequence of events which led to a particular incident. In this digital age, it is important for researchers to become aware of the recent developments in this dynamic field and understand scope for the future. The past decade has witnessed significant technological advancements to aid during a digital investigation. Many methodologies, tools and techniques have found their way into the field designed on forensic principles. Digital forensics has also witnessed many innovative approaches that have been explored to acquire and analyze digital evidence from diverse sources. In this paper, we review the research literature since 2000 and categorize developments in the field into 4 major categories. In recent years the exponential growth of technological has also brought with it some serious challenges for digital forensic research which is elucidated. Within each category, research is sub-classified into conceptual and practical advancements. We highlight the observations made by previous researchers and summarize the research directions for the future.

show abstract

Section: Indexing and Querying Digital Evidencementioning

confidence: 99%

Digital forensic research: current state of the art

Raghavan

2012

CSIT

115

View full text Add to dashboard Cite

show abstract

“…The Real Data Corpus [12] is drawn from a collection of storage media purchased on the second-hand market from around the world. The media are primarily hard drives and flash drives.…”

Section: Real Data Corpus (Rdc)mentioning

confidence: 99%

“…The second is a Python framework for processing RegXML. The third is a time analysis of hives in two research corpora: a real data set collected from several hundred used computers that were purchased on the secondary market [12], and a longitudinal, realistic data set [24].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

XML Conversion of the Windows Registry for Forensic Processing and Distribution

Nelson

2012

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

The Windows Registry often contains key data that help determine the activities performed on a computer. While some forensic tools format Registry data for common questions that are required to be answered in digital investigations, their output is geared for standalone use, not for indexable content. This paper describes RegXML, an XML syntax designed to represent Windows Registry hive files. RegXML captures the logical structure of a hive and notes the locations of found data within hive files. The paper also describes a Python library designed to be used with RegXML and the results obtained upon applying the library to analyze two forensic corpora. Experimental results are presented based on hundreds of disk images, thousands of hive files and tens of millions of Registry cells.

show abstract

“…The Real Data Corpus consists of more than 2,000 used hard drives purchased on the secondary market for the purpose of cutting-edge forensics research [13].…”

Section: Real Data Corpusmentioning

confidence: 99%

Extending digital repository architectures to support disk image preservation and access

Woods

Lee

Garfinkel

2011

Proceedings of the 11th Annual International ACM/IEEE Joint Conference on Digital Libraries

Self Cite

View full text Add to dashboard Cite

Disk images (bitstreams extracted from physical media) can play an essential role in the acquisition and management of digital collections by serving as containers that support data integrity and chain of custody, while ensuring continued access to the underlying bits without depending on physical carriers. Widely used today by practitioners of digital forensics, disk images can serve as baselines for comparison for digital preservation activities, as they provide fail-safe mechanisms when curatorial actions make unexpected changes to data; enable access to potentially valuable data that resides below the file system level; and provide options for future analysis. We discuss established digital forensics techniques for acquiring, preserving and annotating disk images, provide examples from both research and educational collections, and describe specific forensic tools and techniques, including an object-oriented data packaging framework called the Advanced Forensic Format (AFF) and the Digital Forensics XML (DFXML) metadata representation.

show abstract

Bringing science to digital forensics with standardized forensic corpora

Cited by 304 publications

References 4 publications

Digital forensic research: current state of the art

Digital forensic research: current state of the art

XML Conversion of the Windows Registry for Forensic Processing and Distribution

Extending digital repository architectures to support disk image preservation and access

Contact Info

Product

Resources

About