TY - GEN
T1 - A dual cube hashing scheme for solving LPP integrity problem
AU - Fang, Junbin
AU - Jiang, Zoe L.
AU - Yiu, S. M.
AU - Chow, K. P.
AU - Hui, Lucas C.K.
AU - Chen, Long
AU - Niu, Xiamu
PY - 2011
Y1 - 2011
N2 - In digital forensics, data stored in a hard disk usually contains valuable evidence. Preserving the integrity of the data in the hard disk is a critical issue. A single hash value for the whole hard disk is not appropriate as the investigation may take a long time and latent sector errors (LSEs) (bad sectors due to media imperfection, for example) which cause a sector suddenly unreadable will make the hash value inconsistent. On the other hand, using a hash per sector may need to store a lot of hash values. Previous research has been conducted to use fewer hash values, but can resist some of LSEs to decrease the number of unverifiable sectors even if there are LSEs. This integrity problem is more complicated in the presence of Legal Professional Privileged (LPP) data inside a seized hard disk in digital forensic as the hard disk has to be cloned once seized and the original hard disk will be sealed after cloning. Hash values need to be computed during this cloning process. However, the cloned copy will be returned to the suspect for the deletion of LPP data before the investigator can work on the sanitized copy. Thus, the integrity of unmodified sectors has to be verified using the hash values computed based on the original hard disk. This paper found that existing schemes are not good enough to solve the integrity problem in the presence of both LSEs and deletion of LPP data. We then propose the idea of a "Dual Cube" hashing scheme to solve the problem. The experiments show the proposed scheme performs better than the previous schemes and fits easily into the digital forensic procedure.
AB - In digital forensics, data stored in a hard disk usually contains valuable evidence. Preserving the integrity of the data in the hard disk is a critical issue. A single hash value for the whole hard disk is not appropriate as the investigation may take a long time and latent sector errors (LSEs) (bad sectors due to media imperfection, for example) which cause a sector suddenly unreadable will make the hash value inconsistent. On the other hand, using a hash per sector may need to store a lot of hash values. Previous research has been conducted to use fewer hash values, but can resist some of LSEs to decrease the number of unverifiable sectors even if there are LSEs. This integrity problem is more complicated in the presence of Legal Professional Privileged (LPP) data inside a seized hard disk in digital forensic as the hard disk has to be cloned once seized and the original hard disk will be sealed after cloning. Hash values need to be computed during this cloning process. However, the cloned copy will be returned to the suspect for the deletion of LPP data before the investigator can work on the sanitized copy. Thus, the integrity of unmodified sectors has to be verified using the hash values computed based on the original hard disk. This paper found that existing schemes are not good enough to solve the integrity problem in the presence of both LSEs and deletion of LPP data. We then propose the idea of a "Dual Cube" hashing scheme to solve the problem. The experiments show the proposed scheme performs better than the previous schemes and fits easily into the digital forensic procedure.
KW - 3-Dimension Hashing
KW - Combinatorial Group Testing (CGT)
KW - Hard Disk Sector Allocation
KW - Latent Sector Errors (LSEs)
KW - Legal Professional Privilege (LPP)
UR - https://www.scopus.com/pages/publications/84863338627
U2 - 10.1109/SADFE.2011.1
DO - 10.1109/SADFE.2011.1
M3 - 会议稿件
AN - SCOPUS:84863338627
SN - 9781467312424
T3 - 2011 6th IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011
BT - 2011 6th IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011
T2 - 2011 6th IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2011
Y2 - 26 May 2011 through 26 May 2011
ER -