Reducing the Impact of Network Bottlenecks on Remote Contraband Detection

McKeown, Sean; Russell, Gordon; Leimich, Petra

Abstract

Cloud based storage is increasing in popularity, with
large volumes of data being stored remotely. Digital forensics
investigators examining such systems remotely are limited by
bandwidth constraints when accessing this kind of data using
traditional tools. This paper explores the potential for sub-file
hashing strategies to decrease the time taken to detect contraband
on networked storage devices, while maintaining a high degree
of accuracy. Results show that sub-file hashing is faster than full
file hashing for both LAN and Internet server configurations,
with reduced bandwidth heavily favouring sub-file strategies.

Citation

McKeown, S., Russell, G., & Leimich, P. (2018). Reducing the Impact of Network Bottlenecks on Remote Contraband Detection. In 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security). https://doi.org/10.1109/CyberSecPODS.2018.8560671

• Conference Name: IEEE International Conference on Cyber Security and Protection of Digital Services (Cyber Security 2018)
• Conference Location: Glasgow, UK
• Start Date: Jun 11, 2018
• End Date: Jun 12, 2018
• Acceptance Date: Mar 31, 2018
• Publication Date: Dec 6, 2018
• Deposit Date: May 24, 2018
• Publicly Available Date: May 25, 2018
• Publisher: Institute of Electrical and Electronics Engineers
• Book Title: 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)
• ISBN: 9781538646847
• DOI: https://doi.org/10.1109/CyberSecPODS.2018.8560671
• Keywords: networked storage, cloud storage forensics, file server, sub-file signatures, partial-file analysis, hashing strategies, digital forensics, cryptographic hashing, logical acquisition
• Public URL: http://researchrepository.napier.ac.uk/Output/1174803