Inproceedings
Towards the Leveraging of Data Deduplication to Break the Disk Acquisition Speed Limit
Contribution Summary
This paper presents a novel approach to digital forensic evidence acquisition and analysis by leveraging a data deduplication system. The proposed system aims to expedite the acquisition and analysis phases of a typical investigation by eliminating the unnecessary reacquisition and analysis of previously processed data. The system uses a deduplicated forensic data storage system to store and manage digital evidence, allowing for efficient storage and retrieval of relevant data. The authors present a prototype implementation of the system and provide preliminary results of its effectiveness in reducing acquisition time and improving the overall efficiency of the digital forensic process. The proposed system has the potential to significantly impact the digital forensic community by reducing the time and resources required for evidence analysis, thereby improving the overall efficiency of the digital forensic process.
Keywords: Data Deduplication; Digital Forensic Evidence Acquisition; Digital Forensics; Evidence Analysis; Forensic Data Storage; Digital Forensic Backlog; Remote Acquisition; Automation
Abstract
Digital forensic evidence acquisition speed is traditionally limited by two main factors: the read speed of the storage device being investigated, i.e., the read speed of the disk, memory, remote storage, mobile device, etc.), and the write speed of the system used for storing the acquired data. Digital forensic investigators can somewhat mitigate the latter issue through the use of high-speed storage options, such as networked RAID storage, in the controlled environment of the forensic laboratory. However, traditionally, little can be done to improve the acquisition speed past its physical read speed from the target device itself. The protracted time taken for data acquisition wastes digital forensic experts' time, contributes to digital forensic investigation backlogs worldwide, and delays pertinent information from potentially influencing the direction of an investigation. In a remote acquisition scenario, a third contributing factor can also become a detriment to the overall acquisition time - typically the Internet upload speed of the acquisition system. This paper explores an alternative to the traditional evidence acquisition model through the leveraging of a forensic data deduplication system. The advantages that a deduplicated approach can provide over the current digital forensic evidence acquisition process are outlined and some preliminary results of a prototype implementation are discussed.
BibTeX
@inproceedings{wolahan2016deduplication,
author={Wolahan, Hannah and Lorenzo, Claudio Chico and Bou-Harb, Elias and Scanlon, Mark},
title="{Towards the Leveraging of Data Deduplication to Break the Disk Acquisition Speed Limit}",
booktitle="{Proceedings of the IFIP International Workshop on Cybercrime Investigation and Digital Forensics (CID)}",
year=2016,
month=11,
address={Larnaca Bay, Cyprus},
publisher={IEEE},
pages="1-5",
abstract="Digital forensic evidence acquisition speed is traditionally limited by two main factors: the read speed of the storage device being investigated, i.e., the read speed of the disk, memory, remote storage, mobile device, etc.), and the write speed of the system used for storing the acquired data. Digital forensic investigators can somewhat mitigate the latter issue through the use of high-speed storage options, such as networked RAID storage, in the controlled environment of the forensic laboratory. However, traditionally, little can be done to improve the acquisition speed past its physical read speed from the target device itself. The protracted time taken for data acquisition wastes digital forensic experts' time, contributes to digital forensic investigation backlogs worldwide, and delays pertinent information from potentially influencing the direction of an investigation. In a remote acquisition scenario, a third contributing factor can also become a detriment to the overall acquisition time -- typically the Internet upload speed of the acquisition system. This paper explores an alternative to the traditional evidence acquisition model through the leveraging of a forensic data deduplication system. The advantages that a deduplicated approach can provide over the current digital forensic evidence acquisition process are outlined and some preliminary results of a prototype implementation are discussed.",
doi={10.1109/NTMS.2016.7792486},
}