TU Darmstadt / ULB / TUbiblio

Model-Based Generation of Synthetic Disk Images for Digital Forensic Tool Testing

Yannikos, York and Winter, Christian (2013):
Model-Based Generation of Synthetic Disk Images for Digital Forensic Tool Testing.
E5008, In: Availability, Reliability and Security (ARES 2013), Eighth International Conference, September 2–6, 2013, Regensburg, Germany, IEEE Computer Society, Regensburg, Germany, pp. 498–505, DOI: 10.1109/ARES.2013.65,
[Conference or Workshop Item]

Abstract

Testing digital forensic tools is important to determine relevant tool properties like effectiveness and efficiency. Since many different forensic tool categories exist, different testing techniques and especially suitable test data are required. Considering test data for disk analysis and data recovery tools, synthetic disk images provide significant advantages compared to disk images created from real-world storage devices.

In this work we propose a framework for generating synthetic disk images for testing digital forensic analysis tools. The framework provides functionality for building models of real-world scenarios in which data on a storage device like a hard disk is created, changed, or deleted. Using such a model our framework allows simulating actions specified in the model in order to generate synthetic disk images with realistic characteristics. These disk images can then be used for testing the performance of forensic disk analysis and data recovery tools.

Item Type: Conference or Workshop Item
Erschienen: 2013
Creators: Yannikos, York and Winter, Christian
Title: Model-Based Generation of Synthetic Disk Images for Digital Forensic Tool Testing
Language: ["languages_typename_1" not defined]
Abstract:

Testing digital forensic tools is important to determine relevant tool properties like effectiveness and efficiency. Since many different forensic tool categories exist, different testing techniques and especially suitable test data are required. Considering test data for disk analysis and data recovery tools, synthetic disk images provide significant advantages compared to disk images created from real-world storage devices.

In this work we propose a framework for generating synthetic disk images for testing digital forensic analysis tools. The framework provides functionality for building models of real-world scenarios in which data on a storage device like a hard disk is created, changed, or deleted. Using such a model our framework allows simulating actions specified in the model in order to generate synthetic disk images with realistic characteristics. These disk images can then be used for testing the performance of forensic disk analysis and data recovery tools.

Title of Book: Availability, Reliability and Security (ARES 2013), Eighth International Conference, September 2–6, 2013, Regensburg, Germany
Volume: E5008
Publisher: IEEE Computer Society
Uncontrolled Keywords: Secure Data;Synthetic disk image generation, forensic tool testing, disk analysis tools, Markov chains, model-based simulation
Divisions: LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
LOEWE > LOEWE-Zentren
LOEWE
Event Location: Regensburg, Germany
Date Deposited: 30 Dec 2016 20:23
DOI: 10.1109/ARES.2013.65
Identification Number: TUD-CS-2013-0442
Export:
Suche nach Titel in: TUfind oder in Google
Send an inquiry Send an inquiry

Options (only for editors)

View Item View Item