Skip to main content

Research Repository

Advanced Search

Fast contraband detection in large capacity disk drives

Penrose, Philip; Buchanan, William J; Macfarlane, Richard

Authors

Philip Penrose



Abstract

In recent years the capacity of digital storage devices has been increasing at a rate that has left digital forensic services struggling to cope. There is an acknowledgement that current forensic tools have failed to keep up. The workload is such that a form of ‘administrative triage’ takes place in many labs where perceived low priority jobs are delayed or dropped without reference to the data itself. In this paper we investigate the feasibility of first responders performing a fast initial scan of a device by sampling on the device itself. A Bloom filter is used to store the block hashes of large collections of contraband data. We show that by sampling disk clusters, we can achieve 99.9% accuracy scanning for contraband data in minutes. Even under the constraints imposed by low specification legacy equipment, it is possible to scan a device for contraband with a known and controllable margin of error in a reasonable time. We conclude that in this type of case it is feasible to boot the device into a forensically sound environment and do a pre-imaging scan to prioritise the device for further detailed investigation.

Citation

Penrose, P., Buchanan, W. J., & Macfarlane, R. (2015, March). Fast contraband detection in large capacity disk drives. Presented at DFRWS 2015 Europe, Dublin, Republic of Ireland

Presentation Conference Type Conference Paper (published)
Conference Name DFRWS 2015 Europe
Start Date Mar 23, 2015
End Date Mar 25, 2015
Online Publication Date Mar 6, 2015
Publication Date 2015-03
Deposit Date Mar 11, 2015
Publicly Available Date May 15, 2017
Journal Digital Investigation
Print ISSN 1742-2876
Publisher Elsevier
Peer Reviewed Peer Reviewed
Volume 12
Issue S1
Pages S22-S29
DOI https://doi.org/10.1016/j.diin.2015.01.007
Keywords Disk sampling; Contraband detection; Digital forensics; Triage; Bloom filter; Sampling; Sample size;
Public URL http://researchrepository.napier.ac.uk/id/eprint/7670
Contract Date May 15, 2017

Files









Downloadable Citations