Impacts of increasing volume of digital forensic data

Digital forensics is the process of employing scientific principles and processes to analyze electronically stored information and determine the sequence of events which led to a particular incident. In this digital age, it is important for researchers to become aware of the recent developments in this dynamic field and understand scope for the future. The past decade has witnessed significant technological advancements to aid during a digital investigation. Many methodologies, tools and techniques have found their way into the field designed on forensic principles. Digital forensics has also witnessed many innovative approaches that have been explored to acquire and analyze digital evidence from diverse sources. In this paper, we review the research literature since 2000 and categorize developments in the field into four major categories. In recent years the exponential growth of technological has also brought with it some serious challenges for digital forensic research which is elucidated. Within each category, research is sub-classified into conceptual and practical advancements. We highlight the observations made by previous researchers and summarize the research directions for the future.

/pdf/digital-forensic-research-current-state-of-the-art-3zfd1s9rcl.pdf

Digital forensic research: current state of the art

An issue that continues to impact digital forensics is the increasing volume of data and the growing number of devices. One proposed method to deal with the problem of "big digital forensic data": the volume, variety, and velocity of digital forensic data, is to reduce the volume of data at either the collection stage or the processing stage. We have developed a novel approach which significantly improves on current practice, and in this paper we outline our data volume reduction process which focuses on imaging a selection of key files and data such as: registry, documents, spreadsheets, email, internet history, communications, logs, pictures, videos, and other relevant file types. When applied to test cases, a hundredfold reduction of original media volume was observed. When applied to real world cases of an Australian Law Enforcement Agency, the data volume further reduced to a small percentage of the original media volume, whilst retaining key evidential files and data. The reduction process was applied to a range of real world cases reviewed by experienced investigators and detectives and highlighted that evidential data was present in the data reduced forensic subset files. A data reduction approach is applicable in a range of areas, including: digital forensic triage, analysis, review, intelligence analysis, presentation, and archiving. In addition, the data reduction process outlined can be applied using common digital forensic hardware and software solutions available in appropriately equipped digital forensic labs without requiring additional purchase of software or hardware. The process can be applied to a wide variety of cases, such as terrorism and organised crime investigations, and the proposed data reduction process is intended to provide a capability to rapidly process data and gain an understanding of the information and/or locate key evidence or intelligence in a timely manner.

Big forensic data reduction: digital forensic images and electronic evidence

Leveraging CybOX to standardize representation and exchange of digital forensic information

The volume of digital forensic evidence is rapidly increasing, leading to large backlogs. In this paper, a Digital Forensic Data Reduction and Data Mining Framework is proposed. Initial research with sample data from South Australia Police Electronic Crime Section and Digital Corpora Forensic Images using the proposed framework resulted in significant reduction in the storage requirements — the reduced subset is only 0.196 percent and 0.75 percent respectively of the original data volume. The framework outlined is not suggested to replace full analysis, but serves to provide a rapid triage, collection, intelligence analysis, review and storage methodology to support the various stages of digital forensic examinations. Agencies that can undertake rapid assessment of seized data can more effectively target specific criminal matters. The framework may also provide a greater potential intelligence gain from analysis of current and historical data in a timely manner, and the ability to undertake research of trends over time.

Data Reduction and Data Mining Framework for Digital Forensic Evidence: Storage, Intelligence, Review and Archive

High-speed search using Tarari content processor in digital forensics

In this paper, we describe a new forensic image format which can handle high capacity computer disk storages like IDE, SAT A, USB, or etc. And also, it supports metadata that can be defined and extended by users. Especially, it has flag field in which users set the encryption and digital signature algorithms.

A New Forensic Image Format for High Capacity Disk Storage

Disclosed herein are a method that generates an index for an efficient range search in an encrypted DB, and a decryption apparatus and method that are capable of searching for desired data and decrypting search results using the index generation method. The presented index generation method includes preparing a private key and a one-way function, calculating a tag for an input plaintext interval using the private key and the one-way function, and dividing the plaintext interval into a plurality of partial intervals, encrypting information of a partial interval including plaintext using the tag, and then generating an encrypted index.

Decryptable index generation method for range search, search method, and decryption method

Security requirements of the embedded system which were not considered when the embedded system is independently deployed are being increased because the embedded system is connected to an internet. Accordingly, the coverage of the system security is being expanded from the general server to the embedded system. And it is not enough that the embedded system supports only its inherent functions and it becomes the essential element to provide the security function to the embedded system. This paper implements the Role Based Access Control (RBAC) module which is designed using the Linux Security Module (LSM) for the embedded system. RBAC allows security management to be administrated easily and LSM is a lightweight, general purpose, access control framework for mainstream Linux kernel that enables many different access control models. The combination of RABC and LSM properties is very suitable for one of security solutions of embedded system because of the simplicity and flexibility of RBAC and a lightweight loadable mechanism of LSM. And we show the performance of our implementation that has very small overhead for the intended processing and is acceptable.

Implementation of LSM-based RBAC module for embedded system

Exemplary embodiments of the present invention relate to a batch verification method for verifying a plurality of authentication data or digital signature values and an apparatus thereof. A batch verification method according to an embodiment of the present invention comprises: rearranging N pairs of individual instances which compose a batch verification instance; selecting N−1 verification exponents from a verification exponent set E which is used for the batch verification; and performing the batch verification for the rearranged batch verification instance by using the selected verification exponents. Exemplary embodiments of the present invention can be suitable for digital signature and cryptographic confirmation. According to exemplary embodiments, verification computation amount of a plurality of authentication data or digital signature values can be significantly reduced.

Sung-Kyong Un

Papers

High-speed search using Tarari content processor in digital forensics

A New Forensic Image Format for High Capacity Disk Storage

Decryptable index generation method for range search, search method, and decryption method

Implementation of LSM-based RBAC module for embedded system

Batch verification method and apparatus thereof