Gradually Improving the Forensic Process

Abstract

At the time of writing, one of the most pressing problems for forensic investigators is the huge amount of data to analyze per case. Not only the number of devices increases due to the advancing computerization of everydays life, but also the storage capacity of each and every device raises into multiterabyte storage requirements per case for forensic working images. In this paper we improve the standardized forensic process by proposing to use file deduplication across devices as well as file whitelisting rigorously in investigations, to reduce the amount of data that needs to be stored for analysis as early as during data acquisition. These improvements happen in an automatic fashion and completely transparent to the forensic investigator. They furthermore be added without negative effects to the chain of custody or artefact validity in court, and are evaluated in a realistic use case.

Effectiveness of file‐based deduplication in digital forensics

“…In this section, we first describe the theoretical approach as described in the original paper by Neuner et al , . This first part is described an artificial scenario.…”

“…This paper is the extended version of the paper by Neuner et al , and was funded by COMET K1, FFG ‐ Austrian Research Promotion Agency and by FFG grant 846070: SpeedFor. Additionally, we want to thank the employees of SBA Research for giving us access to their data and process power.…”

Methodology for the Automated Metadata-Based Classification of Incriminating Digital Forensic Artefacts

“…This technique can work on top of the DFaaS framework. The employment of data deduplication techniques effectively reduces the data required to be processed during the investigation, and potentially blacklisting enables a faster illegal file artefact detection [21,25]. Experimentation has proven the significant savings of the storage and the volumes of data processed in [21] and [8].…”

“…Based on the DFaaS paradigm, data deduplication was proposed for reducing the time repeatedly acquiring and analysing known file artefacts [25]. Several experiments have been performed that proves the increased efficiency created by a deduplication system [8,21,28]. Creation of centralised artefact whitelisting eliminates the known, benign operating system and application files, and also eliminates known, benign user created files.…”