Significant data region identification and analysis using k‐means in large storage drive forensics. Issue 4 (6th September 2018)

• Record Type: Journal Article
• Authors: Bharadwaj, Nitesh K.; Singh, Upasna
• Is Part Of: Security and privacy. Volume 1:Issue 4(2018)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2018-09-06
• Subjects: k‐means clustering -- large storage drives -- random sector sampling -- selective examination -- significant regions identification -- storage drive forensics -- stored data pattern; Computer security -- Periodicals; Data protection -- Periodicals; Cyberterrorism -- Periodicals; 005.8
• DOI: 10.1002/spy2.40
• Languages: English
• ISSNs: 2475-6725

Abstract

Abstract : The recent technological advancement with less implementation cost has completely changed the scenario of information being generated, stored, or manipulated digitally by using the storage devices. Today the criminal activities are directly or indirectly associated with the storage devices, thus it is now recognized as an essential evidence in court‐of‐law throughout the world. However, the massive capacities of modern storage devices significantly increase the time and effort required to preserve and analyze the evidence. This paper proposes a methodology based on the random sector sampling and k ‐means clustering approaches to efficiently identify and evaluate the significant data regions instead of the entire storage drive. The random sampling and clustering methods efficiently reveal the unseen resident data pattern and intelligence about the regions of the drive which may be of investigator's interest. Experiments involving storage drives of various capacities demonstrate the efficacy of the methodology. Moreover, we generalize our discussion to represent that the extracted hidden patterns of storage drive data can assist an investigator in achieving the desired performance requirements.