Distinct Sector Hashes for Target File Detection

Using an alternative approach to traditional file hashing, digital forensic investigators can hash individually sampled subject drives on sector boundaries and then check these hashes against a prebuilt database, making it possible to process raw media without reference to the underlying file system...

Full description

Saved in:
Bibliographic Details
Published inComputer (Long Beach, Calif.) Vol. 45; no. 12; pp. 28 - 35
Main Authors Young, J., Foster, K., Garfinkel, S., Fairbanks, K.
Format Journal Article
LanguageEnglish
Published New York IEEE 01.12.2012
The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subjects
Boundaries
Computer forensics
computer security
Computers
Cryptography
Digital
Digital forensics
File systems
Forensic engineering
Forensics
Hash based algorithms
Malware
Media
Raw
sector hashing
Target detection
Online AccessGet full text

Cover

More Information
Summary:Using an alternative approach to traditional file hashing, digital forensic investigators can hash individually sampled subject drives on sector boundaries and then check these hashes against a prebuilt database, making it possible to process raw media without reference to the underlying file system.
Bibliography:SourceType-Scholarly Journals-1
ObjectType-Feature-1
content type line 14
ObjectType-Article-2
content type line 23
ISSN:0018-9162
1558-0814
DOI:10.1109/MC.2012.327