Towards a Process Model for Hash Functions in Digital Forensics

Breitinger, Frank; Liu, Huajian; Winter, Christian; Baier, Harald; Rybalchenko, A.; Steinebach, Martin

doi:10.1007/978-3-319-14289-0_12

Cited by 10 publications

(9 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Roussev (2010) describes sdhash, a method for selecting statistically improbable features when producing data fingerprints, while Garfinkel et al (2010) focus on reducing the number of common non-distinct blocks from the hash database. Breitinger et al (2013) compare and contrast the properties of full file cryptographic hashing, bytewise approximate matching, and semantic approximate matching. Binary methods were shown to be much faster, though much less resistant to content preserving modifications, while out performing semantic methods in the realms of damaged or embedded file detection.…”

Section: Forensic File Hashingmentioning

confidence: 99%

Fingerprinting JPEGs With Optimised Huffman Tables

McKeown¹,

Russell²,

Leimich³

2018

JDFSL

View full text Add to dashboard Cite

A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algorithms such as SHA256, for each image on a given medium, and comparing individual digests with a database of known contraband. However, the large capacities of modern storage media and time pressures placed on forensics examiners necessitates the development of more efficient processing methods. This work describes a technique for fingerprinting JPEGs with optimised Huffman tables which requires only the image header to be present on the media. Such fingerprints are shown to be robust across large datasets, with demonstrably faster processing times.

show abstract

Section: Forensic File Hashingmentioning

confidence: 99%

Fingerprinting JPEGs With Optimised Huffman Tables

McKeown¹,

Russell²,

Leimich³

2018

JDFSL

View full text Add to dashboard Cite

show abstract

“…978-1-5386-5541-2/18/$31.00 ©2018 IEEE Modifications to this hashing process have largely focused on detecting similar, rather than identical, files, either by features of their binary data [8]- [10], or by their semantic, human facing, content [11]. However, such similar file detection is slower to process than traditional cryptographic hashing [12].…”

Section: Related Work a Detecting Contrabandmentioning

confidence: 99%

Reducing the Impact of Network Bottlenecks on Remote Contraband Detection

McKeown

Russell

Leimich

2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

Cloud based storage is increasing in popularity, with large volumes of data being stored remotely. Digital forensics investigators examining such systems remotely are limited by bandwidth constraints when accessing this kind of data using traditional tools. This paper explores the potential for sub-file hashing strategies to decrease the time taken to detect contraband on networked storage devices, while maintaining a high degree of accuracy. Results show that sub-file hashing is faster than full file hashing for both LAN and Internet server configurations, with reduced bandwidth heavily favouring sub-file strategies.

show abstract

“…As this work focuses on Bloom filter-based approaches, we briefly describe them in the following. A comprehensive overview of different algorithms is given by (Breitinger, Liu, et al, 2013). Basically approximate matching consists of two separate functions.…”

Section: Bytewise Approximate Matchingmentioning

confidence: 99%

An Efficient Similarity Digests Database Lookup – A Logarithmic Divide & Conquer Approach

Breitinger

Rathgeb

Baier

2014

JDFSL

Self Cite

View full text Add to dashboard Cite

Investigating seized devices within digital forensics represents a challenging task due to the increasing amount of data. Common procedures utilize automated file identification, which reduces the amount of data an investigator has to examine manually. In the past years the research field of approximate matching arises to detect similar data. However, if n denotes the number of similarity digests in a database, then the lookup for a single similarity digest is of complexity of O(n). This paper presents a concept to extend existing approximate matching algorithms, which reduces the lookup complexity from O(n) to O(log(n)). Our proposed approach is based on the well-known divide and conquer paradigm and builds a Bloom filter-based tree data structure in order to enable an efficient lookup of similarity digests. Further, it is demonstrated that the presented technique is highly scalable operating a trade-off between storage requirements and computational efficiency. We perform a theoretical assessment based on recently published results and reasonable magnitudes of input data, and show that the complexity reduction achieved by the proposed technique yields a 2 20 -fold acceleration of look-up costs.

show abstract

Towards a Process Model for Hash Functions in Digital Forensics

Cited by 10 publications

References 25 publications

Fingerprinting JPEGs With Optimised Huffman Tables

Fingerprinting JPEGs With Optimised Huffman Tables

Reducing the Impact of Network Bottlenecks on Remote Contraband Detection

An Efficient Similarity Digests Database Lookup – A Logarithmic Divide & Conquer Approach

Contact Info

Product

Resources

About