A Study of Forensic Imaging to Evaluate “Unsanitized” Destination Storage Media

A Study of Forensic Imaging to Evaluate “Unsanitized” Destination Storage Media

Gregory H. Carlton (California State Polytechnic University, Pomona, USA) and Gary C. Kessler (Embry-Riddle Aeronautical University, Daytona Beach, USA)
DOI: 10.4018/IJITN.2018070105

Abstract

Best practices in digital forensics include a procedure to sanitize media on which forensic images will be stored, thus eliminating potential challenges that contamination of the evidence may occur due to data that exist on the media prior to storing forensic images. This article describes a research project to empirically evaluate the extent to which wiping destination storage media affects evidence. The authors specifically address whether the contents of forensic images differ in any way when written to a freshly wiped and formatted medium when compared to the images being written to a similar medium that had been populated with data and not wiped. They performed these experiments on different types of storage devices.
Article Preview

Testing Framework

Our test framework is presented below in four sections, identified as: hypothesis, test framework, test design, and source data.

Hypotheses

Our null hypothesis is “wiping a storage medium has no affect on the content of a BSIF that is written to that medium.” Thus, we are testing the claim that the sanitization task is unnecessary by a series of experiments to measure the effect that sanitizing (i.e., wiping) target media has on forensically acquired bit-stream images. This hypothesis is based upon the realities of current practice, in particular, the format of modern BSIFs and the large number of instances where the BSIF is written directly to a network storage device that is clearly not “sanitized” prior to such storage.

Complete Article List

Search this Journal:
Reset
Open Access Articles: Forthcoming
Volume 12: 4 Issues (2020): Forthcoming, Available for Pre-Order
Volume 11: 4 Issues (2019): 2 Released, 2 Forthcoming
Volume 10: 4 Issues (2018)
Volume 9: 4 Issues (2017)
Volume 8: 4 Issues (2016)
Volume 7: 4 Issues (2015)
Volume 6: 4 Issues (2014)
Volume 5: 4 Issues (2013)
Volume 4: 4 Issues (2012)
Volume 3: 4 Issues (2011)
Volume 2: 4 Issues (2010)
Volume 1: 4 Issues (2009)
View Complete Journal Contents Listing