TU Darmstadt / ULB / TUbiblio

Model-Based Generation of Synthetic Disk Images for Digital Forensic Tool Testing

Yannikos, York ; Winter, Christian (2013)
Model-Based Generation of Synthetic Disk Images for Digital Forensic Tool Testing.
Regensburg, Germany
doi: 10.1109/ARES.2013.65
Conference or Workshop Item, Bibliographie

Abstract

Testing digital forensic tools is important to determine relevant tool properties like effectiveness and efficiency. Since many different forensic tool categories exist, different testing techniques and especially suitable test data are required. Considering test data for disk analysis and data recovery tools, synthetic disk images provide significant advantages compared to disk images created from real-world storage devices.

In this work we propose a framework for generating synthetic disk images for testing digital forensic analysis tools. The framework provides functionality for building models of real-world scenarios in which data on a storage device like a hard disk is created, changed, or deleted. Using such a model our framework allows simulating actions specified in the model in order to generate synthetic disk images with realistic characteristics. These disk images can then be used for testing the performance of forensic disk analysis and data recovery tools.

Item Type: Conference or Workshop Item
Erschienen: 2013
Creators: Yannikos, York ; Winter, Christian
Type of entry: Bibliographie
Title: Model-Based Generation of Synthetic Disk Images for Digital Forensic Tool Testing
Language: English
Date: 2013
Publisher: IEEE Computer Society
Book Title: Availability, Reliability and Security (ARES 2013), Eighth International Conference, September 2–6, 2013, Regensburg, Germany
Series Volume: E5008
Event Location: Regensburg, Germany
DOI: 10.1109/ARES.2013.65
Abstract:

Testing digital forensic tools is important to determine relevant tool properties like effectiveness and efficiency. Since many different forensic tool categories exist, different testing techniques and especially suitable test data are required. Considering test data for disk analysis and data recovery tools, synthetic disk images provide significant advantages compared to disk images created from real-world storage devices.

In this work we propose a framework for generating synthetic disk images for testing digital forensic analysis tools. The framework provides functionality for building models of real-world scenarios in which data on a storage device like a hard disk is created, changed, or deleted. Using such a model our framework allows simulating actions specified in the model in order to generate synthetic disk images with realistic characteristics. These disk images can then be used for testing the performance of forensic disk analysis and data recovery tools.

Uncontrolled Keywords: Secure Data;Synthetic disk image generation, forensic tool testing, disk analysis tools, Markov chains, model-based simulation
Identification Number: TUD-CS-2013-0442
Divisions: LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
LOEWE > LOEWE-Zentren
LOEWE
Date Deposited: 30 Dec 2016 20:23
Last Modified: 17 May 2018 13:02
PPN:
Export:
Suche nach Titel in: TUfind oder in Google
Send an inquiry Send an inquiry

Options (only for editors)
Show editorial Details Show editorial Details