Hierarchical Bloom Filter Trees for Approximate Matching

Abstract

Bytewise approximate matching algorithms have in recent years shown significant promise in detecting files that are similar at the byte level. This is very useful for digital forensic investigators, who are regularly faced with the problem of searching through a seized device for pertinent data. A common scenario is where an investigator is in possession of a collection of "known-illegal" files (e.g. a collection of child abuse material) and wishes to find whether copies of these are stored on the seized device. Approximate matching addresses shortcomings in traditional hashing, which can only find identical files, by also being able to deal with cases of merged files, embedded files, partial files, or if a file has been changed in any way. Most approximate matching algorithms work by comparing pairs of files, which is not a scalable approach when faced with large corpora. This paper demonstrates the effectiveness of using a "Hierarchical Bloom Filter Tree" (HBFT) data structure to reduce the running time of collection-againstcollection matching, with a specific focus on the MRSH-v2 algorithm. Three experiments are discussed, which explore the effects of different configurations of HBFTs. The proposed approach dramatically reduces the number of pairwise comparisons required, and demonstrates substantial speed gains, while maintaining effectiveness.

Digital Forensics

“…Thus,determining wheredata resides andhowtoacquire datacanposemany challenges to DFEs.Forinstance,theDFanalysisofIoTdevicesusedinabusinessorhomeenvironmentcanbe challenginginrelationtoestablishingwhomdatabelongstosincedigitalartefactsmightbeshared ortransmittedacrossmultipledevices.Inaddition,duetothefactthatIoTdevicesutiliseproprietary formatsfordataandcommunicationprotocols,understandingthelinksbetweenartifactsinbothtime andspacecanbeverycomplex.AnotherchallengerelatedtotheDFIofIoTdevicesconcernsthe chainofcustody.Incivilorcriminaltrial,collectingevidenceinaforensicallysoundmannerand preservingchainofcustodyareofparamountimportance (Montasari,2017c;Montasarietal.,2019;Montasarietal.,2019;Montasari,2018;Montasari,2017a;Montasari,2016e OtherforensicchallengesposedbyIoTdevicesincludeissuessuchasavailability,authenticity and non-repudiation which are essential for forensically sound used of data (Lillis et al, 2016). PersistencyofdataisalsoanotherchallengeposedbyIoTdeviceswhichtendtohavelimitedmemory ornopersistentdatastorage.Consequently,anydatastoredforlongerperiodsislikelytobestored inin-networkhubsortobetransferredtothecloudformorepersistentstorage.Asaresult,problems associatedwithCloudForensics(asdiscussedinSub-Section2.1)willalsoberelevanttothefield ofIoT.Althoughoverthepastfewyears,theresearchcommunityhavebeenexaminingIoTdevices forthepurposesofforensics,theseworksarestillintheirinfancy.Therefore,inordertokeeppace withthenewIoTdevices,IoTForensicsrequiresamulti-facetedapproachinwhichevidencecan becollectedandanalysedfromavarietyofsourcessuchassensordevices,communicationdevices andcloudstorage,etc.…”

Forensic Analysis of Wearable Devices: Fitbit, Garmin and HETP Watches

“…Web applications that have a user account linked to a device and that can be synced will also be reviewed, and finally if any evidence is acquired, how valuable and accurate is the evidence. The increasing amount of digital devices that use various hardware and software increases the challenges and difficulties that face the digital forensics sector [1], current obstacles are indicated by [2] and include complexity, consistency, data volume, and unified time-lining of evidence due to multiple time zones. Digital forensics will be able to assist in a many more crimes and investigations if more is done to fill the research void and by conducting the related research, build a greater knowledge of fitness bands.…”

The Internet of Things and the Smart City: Legal challenges with digital forensics, privacy, and security

“…The IoT and the Smart City bring a new scale and scope to e‐evidence, from all types of governmental, commercial and consumer systems, into the “cloud” and beyond. Inadequate abstraction of objects as evidence, data complexity, diversity and heterogeneity, scale and validation, visualization and identity management challenge our grip on these growing data masses and how legal rules map to the technical implementation ,…”