CT-ISG: A Comprehensive Data Carving Architecture for Digital Forensics

新奥尔良金理查兹大学小组：P060969A数字取证的综合数据雕刻体系结构数字取证中最重要的软件技术之一是文件雕刻，它使用关于常见文件类型的特征数据库来搜索物理磁盘中这些类型的文件。文件雕刻是一种特别强大的技术，因为无论文件系统的类型如何，都可以从原始磁盘映像中检索文件，即使文件元数据已被销毁。文件分割可以在空闲空间、交换文件和文件系统之外的“隐藏”数据中找到与已删除文件相关联的数据。目的是识别文件在磁盘镜像中的起始和结束位置，并将字节序列“雕刻”(复制)成常规文件，以便衡量它们作为证据的价值。目前，文件雕刻的范围很窄，存在很大限制。新文件类型的模式通常是手动创建的，这是一个乏味且容易出错的过程。当前一代的工具会产生许多误报，刻出格式不正确的文件。这浪费了调查人员的时间，他们已经有大量的案件要处理。此外，雕刻还没有广泛应用于易失性介质，如内存和网络流。RAM分割对于已安装恶意软件的低级别检测非常有用，在这种情况下，高级别检测(例如，通过操作系统工具)可能会受到恶意软件的阻碍。网络数据流切割可以帮助调查人员确定是否传输了特定文档，或者是否传输了特定文档的版本。这项研究通过扩展当前一代工具中普遍使用的页眉/里程碑/页脚搜索，探索了更好地自动识别文档的技术。该研究还将数据分割的范围扩大到包括内存分析和网络流量分析。整个架构被整合到由PI及其在新奥尔良大学的合作者创建的分布式数字取证框架中。

Golden RichardUniversity of New Orleans0627226Panel: P060969A Comprehensive Data Carving Architecture for Digital ForensicsOne of the most important software techniques in digital forensics is file carving, which uses a database of characteristics about commonly encountered file types to search physical disks for files of these types. File carving is a particularly powerful technique because files can be retrieved from raw disk images, regardless of the type of filesystem, even if file metadata has been destroyed. File carving can find data associated with deleted files, in slack space, swap files, and data "hidden" outside the filesystem. The goal is to identify the starting and ending locations of files in the disk images and "carve" (copy) sequences of bytes into regular files so their value as evidence can be measured.Currently, the scope of file carving is narrow and there are significant limitations. Patterns for new file types are typically created manually, which is a tedious and error-prone process. Current-generation tools generate many false positives, carving files whose formats are incorrect. This wastes the time of investigators, who already have overwhelming caseloads. In addition, carving has not been applied extensively to volatile media such as memory and network flows. RAM carving is useful for low-level detection of installed malware, where high level detection (e.g., via OS facilities) might be thwarted by the malware. Network data flow carving can help investigators determine whether specific documents were transmitted or whether versions of specific documents were transmitted. This research explores techniques for better automatic identification of documents, by expanding on the header/milestone/footer search generally employed in current generation tools. The research also expands the scope of data carving to include memory analysis and network flow analysis. The entire architecture is be incorporated into the distributed digital forensics framework created by the PI and his collaborators at the University of New Orleans.