A Study of Forensic Imaging to Evaluate “Unsanitized” Destination Storage Media

A Study of Forensic Imaging to Evaluate “Unsanitized” Destination Storage Media

Gregory H. Carlton, Gary C. Kessler
Copyright: © 2018 |Pages: 7
DOI: 10.4018/IJITN.2018070105
OnDemand:
(Individual Articles)
Available
$37.50
Current Special Offers
No Current Special Offers
TOTAL SAVINGS: $37.50

Abstract

Best practices in digital forensics include a procedure to sanitize media on which forensic images will be stored, thus eliminating potential challenges that contamination of the evidence may occur due to data that exist on the media prior to storing forensic images. This article describes a research project to empirically evaluate the extent to which wiping destination storage media affects evidence. The authors specifically address whether the contents of forensic images differ in any way when written to a freshly wiped and formatted medium when compared to the images being written to a similar medium that had been populated with data and not wiped. They performed these experiments on different types of storage devices.
Article Preview
Top

Testing Framework

Our test framework is presented below in four sections, identified as: hypothesis, test framework, test design, and source data.

Hypotheses

Our null hypothesis is “wiping a storage medium has no affect on the content of a BSIF that is written to that medium.” Thus, we are testing the claim that the sanitization task is unnecessary by a series of experiments to measure the effect that sanitizing (i.e., wiping) target media has on forensically acquired bit-stream images. This hypothesis is based upon the realities of current practice, in particular, the format of modern BSIFs and the large number of instances where the BSIF is written directly to a network storage device that is clearly not “sanitized” prior to such storage.

Complete Article List

Search this Journal:
Reset
Volume 16: 1 Issue (2024)
Volume 15: 1 Issue (2023)
Volume 14: 1 Issue (2022)
Volume 13: 4 Issues (2021)
Volume 12: 4 Issues (2020)
Volume 11: 4 Issues (2019)
Volume 10: 4 Issues (2018)
Volume 9: 4 Issues (2017)
Volume 8: 4 Issues (2016)
Volume 7: 4 Issues (2015)
Volume 6: 4 Issues (2014)
Volume 5: 4 Issues (2013)
Volume 4: 4 Issues (2012)
Volume 3: 4 Issues (2011)
Volume 2: 4 Issues (2010)
Volume 1: 4 Issues (2009)
View Complete Journal Contents Listing