Skip to main content

Research Repository

Advanced Search

Experimental evaluation of disk sector hash comparison for forensic triage using a Bloom filter.

Buchanan, William J; Macfarlane, Richard; Clayton, John


John Clayton


George Weir

Michael Daley


There is a problem in the world of digital forensics. The demands on digital forensic investigators and resources will continue to increase as the use of computers and other electronic devices increases, and as the storage capacity of these devices increases. The digital forensic process requires that evidence be identified and examined, and resources to do this are constrained. This is creating a backlog of work as seized media and devices wait to be analysed, and some investigations or checks 'in the field' may be reduced or discarded as impractical. There is a technique which can be used to help quickly to collect and examine data to see if it is of interest. This technique combines statistical sampling and hashes as described by Garfinkel et al (2010). This tool can use a Bloom filter to match the hashes from disk sectors against the stored hashes for a file which is being searched for. The tool was successfully implemented and the Bloom filter false positive rate was as predicted by theory (Roussev, Chen, Bourg, & Richard, 2006) which confirmed that the Bloom filter had been correctly implemented. This tool was written in Python which proved a simple to use programming language. This prototype tool can provide the basis for further work on a practical tool for use in real world digital forensics investigation.

Presentation Conference Type Conference Paper (Published)
Conference Name Cyberforensics 2013
Start Date Jun 10, 2013
End Date Jun 11, 2013
Publication Date 2013
Deposit Date Nov 5, 2013
Publicly Available Date Dec 31, 2013
Peer Reviewed Peer Reviewed
Book Title Cyberforensics Perspectives : Proceedings of the 3rd International Conference on Cybercrime, Security and Digital Forensics (Cyberforensics 2013)
ISBN 9780947649975
Keywords Digital forensics; statistical sampling; hashes; Boom filter;
Public URL
Publisher URL
Contract Date Nov 5, 2013


You might also like

Downloadable Citations