QUT ePrints

Hash based disk imaging using AFF4

Schatz, Bradley & Cohen, Michael (2010) Hash based disk imaging using AFF4. In Digital Investigation : The Proceedings of the Tenth Annual Digital Forensic Research Workshop Conference, Elseveir, Portland, Oregon, S121-S128.

View at publisher

Abstract

Forensic imaging has been facing scalability challenges for some time. As disk capacity growth continues to outpace storage IO bandwidth, the demands placed on storage and time are ever increasing. Data reduction and de-duplication technologies are now commonplace in the Enterprise space, and are potentially applicable to forensic acquisition. Using the new AFF4 forensic file format we employ a hash based compression scheme to leverage an existing corpus of images, reducing both acquisition time and storage requirements. This paper additionally describes some of the recent evolution in the AFF4 file format making the efficient implementation of hash based imaging a reality.

Impact and interest:

3 citations in Scopus
Search Google Scholar™
2 citations in Web of Science®

Citation countsare sourced monthly from Scopus and Web of Science® citation databases.

These databases contain citations from different subsets of available publications and different time periods and thus the citation count from each is usually different. Some works are not in either database and no count is displayed. Scopus includes citations from articles published in 1996 onwards, and Web of Science® generally from 1980 onwards.

Citations counts from the Google Scholar™ indexing service can be viewed at the linked Google Scholar™ search.

ID Code: 37239
Item Type: Conference Paper
Additional Information: Presentation and published version of paper are available via the Official URl.
Keywords: Digital forensics, Representation, Evidence containers
DOI: 10.1016/j.diin.2010.05.015
ISSN: 1742-2876
Subjects: Australian and New Zealand Standard Research Classification > INFORMATION AND COMPUTING SCIENCES (080000) > COMPUTER SOFTWARE (080300) > Computer System Security (080303)
Australian and New Zealand Standard Research Classification > INFORMATION AND COMPUTING SCIENCES (080000) > DATA FORMAT (080400) > Data Structures (080403)
Australian and New Zealand Standard Research Classification > INFORMATION AND COMPUTING SCIENCES (080000) > INFORMATION SYSTEMS (080600) > Conceptual Modelling (080603)
Divisions: Past > QUT Faculties & Divisions > Faculty of Science and Technology
Past > Institutes > Information Security Institute
Deposited On: 24 Sep 2010 13:57
Last Modified: 01 Mar 2012 00:19

Export: EndNote | Dublin Core | BibTeX

Repository Staff Only: item control page