Title :
Distinct Sector Hashes for Target File Detection
Author :
Young, Joel ; Foster, Kristina ; Garfinkel, Simson ; Fairbanks, Kevin
Abstract :
Using an alternative approach to traditional file hashing, digital forensic investigators can hash individually sampled subject drives on sector boundaries and then check these hashes against a prebuilt database, making it possible to process raw media without reference to the underlying file system.
Keywords :
digital forensics; disc drives; file organisation; digital forensic investigators; distinct sector hash; file hashing; file system; hash checking; raw media processing; sampled subject drive; sector boundary; target file detection; Computers; Cryptography; Digital forensics; File systems; Forensics; Malware; computer security; digital forensics; sector hashing;
DOI :
10.1109/MC.2012.327
