This paper explores the use of purpose-built functions and cryptographic hashes of small data blocks for identifying data in sectors, file fragments, and entire files. It introduces and defines the concept of a "distinct" disk sectorda sector that is unlikely to exist elsewhere except as a copy of the original. Techniques are presented for improved detection of JPEG, MPEG and compressed data; for rapidly classifying the forensic contents of a drive using random sampling; and for carving data based on sector hashes. ª 2010 Digital Forensic Research Workshop. Published by Elsevier Ltd. All rights reserved. Much of computer forensics practice has focused on the recovery of files from media and the establishment of timelines. This paper presents research in the area of bulk data analysis, and specifically in the forensics of small data blocks. There is a growing need for automated techniques and tools that operate on bulk data, and specifically on bulk data at the block level: File systems and files may not be recoverable due to damage, media failure, partial overwriting, or the use of an unknown file system. There may be insufficient time to read the entire file system, or a need to process data in parallel. File contents may be encrypted. The tree structure of file systems makes it hard to parallelize many types of forensic operations. All of these problems can be addressed through the use of small block forensics. When individual files cannot be recovered, small block techniques can be used to analyze file fragments. When there is insufficient time to analyze the entire disk, small block techniques can analyze a statistically significant sample. These techniques also allow a single disk image to be split into multiple pieces and processed in parallel. Finally, because each block of an encrypted file is distinct, block-level techniques can be used to track the movement of encrypted files within an organization, even when the files themselves cannot be decrypted, because every block of every well-encrypted file should be distinct. In this paper we introduce an approach for performing small block forensics. Some of this work is based upon block hash calculationsdthat is, the calculation of cryptographic hashes on individual blocks of data, rather than on entire files. Other work is based on bulk data analysisdthe examination of blocks of data for specific features or traits irrespective of file boundaries. Although we discuss these techniques in the context of files, they can be applied with equal validity to data from memory images and from computer networks at either the level of IP packets or reassembled TCP streams.
REF performed forensic analysis at the block and sector level.
Using purpose-built functions and block hashes to enable small block and sub-file forensics
Digital Investigation
Computer Science