Hash based disk imaging using AFF4
Schatz, Bradley & Cohen, Michael (2010) Hash based disk imaging using AFF4. In Digital Investigation : The Proceedings of the Tenth Annual Digital Forensic Research Workshop Conference, Elseveir, Portland, Oregon, S121-S128.
Forensic imaging has been facing scalability challenges for some time. As disk capacity growth continues to outpace storage IO bandwidth, the demands placed on storage and time are ever increasing. Data reduction and de-duplication technologies are now commonplace in the Enterprise space, and are potentially applicable to forensic acquisition. Using the new AFF4 forensic file format we employ a hash based compression scheme to leverage an existing corpus of images, reducing both acquisition time and storage requirements. This paper additionally describes some of the recent evolution in the AFF4 file format making the efficient implementation of hash based imaging a reality.
Impact and interest:
Citation counts are sourced monthly from and citation databases.
Citations counts from theindexing service can be viewed at the linked Google Scholar™ search.
|Item Type:||Conference Paper|
|Additional Information:||Presentation and published version of paper are available via the Official URl.|
|Keywords:||Digital forensics, Representation, Evidence containers|
|Subjects:||Australian and New Zealand Standard Research Classification > INFORMATION AND COMPUTING SCIENCES (080000) > COMPUTER SOFTWARE (080300) > Computer System Security (080303)
Australian and New Zealand Standard Research Classification > INFORMATION AND COMPUTING SCIENCES (080000) > DATA FORMAT (080400) > Data Structures (080403)
Australian and New Zealand Standard Research Classification > INFORMATION AND COMPUTING SCIENCES (080000) > INFORMATION SYSTEMS (080600) > Conceptual Modelling (080603)
|Divisions:||Past > QUT Faculties & Divisions > Faculty of Science and Technology
Past > Institutes > Information Security Institute
|Deposited On:||24 Sep 2010 03:57|
|Last Modified:||29 Feb 2012 14:19|
Repository Staff Only: item control page