Characterizing loss of digital evidence due to abstraction layers. (March 2017)

• Record Type: Journal Article
• Authors: Freiling, Felix; Glanzmann, Thomas; Reiser, Hans P.
• Is Part Of: Digital investigation. Volume 20(2016)Supplement
• Page Start: S107
• Page End: S115
• Publication Date: 2017-03
• Subjects: Abstraction layer -- Virtualization -- Forensic analysis -- File system -- Virtual memory; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2017.01.012
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: We study the problem of evidence collection in environments where abstraction layers are used to organize data storage. Based on a formal model, the problem of evidence collection is defined as the task to reconstruct high-level from low-level storage. We investigate the conditions under which different levels of evidence collection can be performed and show that abstraction layers, in general, make it harder to acquire evidence. We illustrate our findings by describing several practical scenarios from file systems, memory management, and disk volume management.