Performance of a Logical, Five- Phase, Multithreaded, Bootable Triage Tool
Performance of a Logical, Five- Phase, Multithreaded, Bootable Triage Tool
复制标题
逻辑、五阶段、多线程、可启动分类工具的性能
DOI：
10.1007/978-3-662-44952-3_19
复制
发表时间：
2014
期刊：
影响因子：
--
通讯作者：
Yasser Jafar
中科院分区：
文献类型：
--
作者：
I. Baggili;Andrew Marrington;Yasser Jafar
本文描述了一种五阶段、多线程的可引导数字取证分类方法，该方法在名为Forensics 2020的产品中实现。第一阶段收集计算机系统硬盘驱动器上每个逻辑文件的元数据。第二阶段从硬盘上找到的每个图像中收集EXIF相机数据。第三阶段根据文件头信息对每个文件进行分析和分类。第四阶段解析每个可执行文件，以提供对系统上软件应用程序的完整审计;为每个可执行文件生成签名，然后根据威胁检测数据库进行检查。第五个也是最后一个阶段对每个文件进行散列并记录其散列值。所有五个阶段都在后台执行，而第一响应者与系统交互。本文评估了Forensics 2020的法医稳健性。该工具对硬盘驱动器进行了某些更改，这些更改与其他可引导法医检查环境所做的更改类似，尽管更改数量更多。本文还介绍了从开发Forensics 2020中吸取的经验教训，这可以帮助指导其他法医分类工具的开发。
This paper describes a five-phase, multi-threaded bootable approach to digital forensic triage, which is implemented in a product called Forensics2020. The first phase collects metadata for every logical file on the hard drive of a computer system. The second phase collects EXIF camera data from each image found on the hard drive. The third phase analyzes and categorizes each file based on its header information. The fourth phase parses each executable file to provide a complete audit of the software applications on the system; a signature is generated for every executable file, which is later checked against a threat detection database. The fifth and final phase hashes each file and records its hash value. All five phases are performed in the background while the first responder interacts with the system. This paper assesses the forensic soundness of Forensics2020. The tool makes certain changes to a hard drive that are similar to those made by other bootable forensic examination environments, although the changes are greater in number. The paper also describes the lessons learned from developing Forensics2020, which can help guide the development of other forensic triage tools.