Selective Imaging Revisited

Stüttgen, Johannes; Dewald, Andreas; Freiling, Felix C.

doi:10.1109/imf.2013.16

Cited by 8 publications

(6 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Privacy in DF and DF imaging are two different topics but related. Making a bit-by-bit forensic image for the whole storage device has already been proven to be an undesirable solution, especially when investigating large disk volumes, shared server, or distributed storage [5,13,17,22]. In DF labs, many cases are pending due to the huge volume of relevant data [23].…”

Section: Selective Imaging Concept: Concept and State Of The Artmentioning

confidence: 99%

“…This should be based on pre-identified parameters entered by the investigator. In anyway, the fully automatic selection still has several shortcomings, and further research efforts are required to develop a more practical, fully automatic method [22,27].…”

Section: Selective Imaging Concept: Concept and State Of The Artmentioning

confidence: 99%

“…The advanced forensic format 4 (AFF4), proposed by Garfinkel et al [33] has become a standard selective forensic image format. The AFF4 is currently the most suitable forensic format for storing selectively imaged data because it supports multiple objects, encryption, and metadata [22,29]. Most, if not all, DF tools support the selective imaging concept based on the AFF.…”

Section: Selective Imaging Concept: Concept and State Of The Artmentioning

confidence: 99%

See 2 more Smart Citations

Computer Forensics Framework for Efficient and Lawful Privacy-Preserved Investigation

Halboob¹,

Al‐Muhtadi²

2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

Privacy preservation (PP) in Digital forensics (DF) is a conflicted and non-trivial issue. Existing solutions use the searchable encryption concept and, as a result, are not efficient and support only a keyword search. Moreover, the collected forensic data cannot be analyzed using existing well-known digital tools. This research paper first investigates the lawful requirements for PP in DF based on the organization for economic co-operation and development OECB) privacy guidelines. To have an efficient investigation process and meet the increased volume of data, the presented framework is designed based on the selective imaging concept and advanced encryption standard (AES). The proposed framework has two main modules, namely Selective Imaging Module (SIM) and Selective Analysis Module (SAM). The SIM and SAM modules are implemented based on advanced forensic format 4 (AFF4) and SleuthKit open source forensics frameworks, respectively, and, accordingly, the proposed framework is evaluated in a forensically sound manner. The evaluation result is compared with other relevant works and, as a result, the proposed solution provides a privacy-preserving, efficient forensic imaging and analysis process while having also sufficient methods. Moreover, the AFF4 forensic image, produced by the SIM module, can be analyzed not only by SAM, but also by other well-known analysis tools available on the market.

show abstract

Section: Selective Imaging Concept: Concept and State Of The Artmentioning

confidence: 99%

Section: Selective Imaging Concept: Concept and State Of The Artmentioning

confidence: 99%

Section: Selective Imaging Concept: Concept and State Of The Artmentioning

confidence: 99%

See 1 more Smart Citation

Computer Forensics Framework for Efficient and Lawful Privacy-Preserved Investigation

Halboob¹,

Al‐Muhtadi²

2023

Computer Systems Science and Engineering

View full text Add to dashboard Cite

show abstract

“…Our work demonstrates that existing, simple, widely supported formats, though not designed for it, can fully support partial imaging. Stuttgen clarifies the distinction between collecting at the file, filesystem, partition and device (i.e., sector or block) levels, and presents software allowing an investigator to choose particular sectors to image (Stuttgen et al, 2013). However, this is a manual approach, in which the investigator manually chooses each individual sector or file that is desired.…”

Section: Related Workmentioning

confidence: 99%

Rapid forensic imaging of large disks with sifting collectors

Grier

Richard

2015

Digital Investigation

View full text Add to dashboard Cite

a b s t r a c tWe present a new approach to digital forensic evidence acquisition and disk imaging called sifting collectors that images only those regions of a disk with expected forensic value. Sifting collectors produce a sector-by-sector, bit-identical AFF v3 image of selected disk regions that can be mounted and is fully compatible with existing forensic tools and methods. In our test cases, they have achieved an acceleration of >3Â while collecting >95% of the evidence, and in some cases we have observed acceleration of up to 13Â. Sifting collectors challenge many conventional notions about forensic acquisition and may help tame the volume challenge by enabling examiners to rapidly acquire and easily store large disks without sacrificing the many benefits of imaging.

show abstract

“…Analyzing this amount of digital evidence is one of the major challenges that digital forensics is currently faced with [1], [2]. Apart from being more selective in the aquisition process [3], [4], abstraction and automation are considered necessary to survive the data deluge [1]. Still, many aspects of a digital investigation remain a manual and cumbersome task because most tools mainly focus on supporting an investigator in the aquisition and extraction phases of digital evidence in common process models [5], [6].…”

Section: Introduction a Motivationmentioning

confidence: 99%

Forensic Application-Fingerprinting Based on File System Metadata

Kalber

Dewald

Freiling

2013

2013 Seventh International Conference on IT Security Incident Management and IT Forensics

Self Cite

View full text Add to dashboard Cite

While much work has been invested in tools for aquisition and extraction of digital evidence, there are only few tools that allow for automatic event reconstruction. In this paper, we present a generic approach for forensic event reconstruction based on digital evidence from file systems. Our approach applies the idea of fingerprinting to changes made by applications in file system metadata. We present a system with which it is possible to automatically compute file system fingerprints of individual actions. Using NTFS timestamps as an example, we show that with our approach it is possible to automatically reconstruct actions performed by different applications even if the set of files accessed by those actions overlap.

show abstract

Selective Imaging Revisited

Cited by 8 publications

References 10 publications

Computer Forensics Framework for Efficient and Lawful Privacy-Preserved Investigation

Computer Forensics Framework for Efficient and Lawful Privacy-Preserved Investigation

Rapid forensic imaging of large disks with sifting collectors

Forensic Application-Fingerprinting Based on File System Metadata

Contact Info

Product

Resources

About