Forensic corpus data reduction techniques for faster analysis by eliminating tedious files. Issue 4 (3rd September 2019)

• Record Type: Journal Article
• Authors: Joseph, Paul; Norman, Jasmine
• Is Part Of: Information security journal. Volume 28:Issue 4/5(2019)
• Page Start: 136
• Page End: 147
• Publication Date: 2019-09-03
• Subjects: Forensic science -- corpus reduction techniques -- digital forensics -- data reduction -- disk forensics -- forensics triage -- file elimination -- real drive corpus -- uninteresting files; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1080/19393555.2019.1689319
• Languages: English
• ISSNs: 1939-3555

Abstract

ABSTRACT: Digital Forensics, an emerging research field, became prominent due to cyber exploitations and cybercrimes. Forensic analysis plays an eminent role in finding and detecting cyber criminals. It is for this purpose, the compromised systems or targeted systems are seized, forensically validated and analyzed in the investigation labs. Globally, though there are many Forensic investigation agencies like Federal Bureau of Investigation (FBI), Department of Défense Cyber Crime Center (CC3), Central Bureau of Investigation (CBI) along with their central forensic labs, many digital evidence analysis (DEA) cases have been pending throughout the past two decades in these forensic labs. The significant and crucial reason contributing to this is the volume of the digital data to be analyzed forensically. Though there are handy tools and effective analysis algorithms, still forensic tools lack the capability of digging tons of data within polynomial time. One of the best methods to reduce time is to eliminate unwanted or uninteresting forensic files. Some limited papers and techniques define this problem, and this research proposes a methodology that gratifies the existing problem by using filtering techniques based on identified parameters and with massive hash sets. This work reduced the present study's corpus to 29.8 million from 79.2 million by applying the proposed methodology. Abbreviations: AFF: Advanced Forensic Format; CBI: Central Bureau of Investigation; CC3: Department of Défense Cyber Crime Centre; CFReDS: Computer Forensic Reference Datasets; DEA: Digital Evidence Analysis; DRbSI: Digital Forensic Data Reduction by Selective Imaging; FBI: Federal Bureau of Investigation; HTML: Hyper Text Markup Language; KPMG: Klynveld Peat Marwick Goerdeler; LCS: Longest Common Substring; MD5: Message Digest Algorithm; NCRB: National Crime Records Bureau; NPS: Naval Postgraduate School; NSRL: National Software Reference Library; RDC: Real Drive Corpus; SHA-1: Secure Hash Algorithm; VMDK: Virtual Machine Disk File.