DocumentCode :
3402325
Title :
A Dual Cube Hashing Scheme for Solving LPP Integrity Problem
Author :
Fang, Junbin ; Jiang, Zoe L. ; Yiu, S.M. ; Chow, K.P. ; Hui, Lucas C K ; Chen, Long ; Niu, Xiamu
Author_Institution :
Dept. of Comput. Sci., Univ. of Hong Kong, Hong Kong, China
fYear :
2011
fDate :
26-26 May 2011
Firstpage :
1
Lastpage :
7
Abstract :
In digital forensics, data stored in a hard disk usually contains valuable evidence. Preserving the integrity of the data in the hard disk is a critical issue. A single hash value for the whole hard disk is not appropriate as the investigation may take a long time and latent sector errors (LSEs) (bad sectors due to media imperfection, for example) which cause a sector suddenly unreadable will make the hash value inconsistent. On the other hand, using a hash per sector may need to store a lot of hash values. Previous research has been conducted to use fewer hash values, but can resist some of LSEs to decrease the number of unverifiable sectors even if there are LSEs. This integrity problem is more complicated in the presence of Legal Professional Privileged (LPP) data inside a seized hard disk in digital forensic as the hard disk has to be cloned once seized and the original hard disk will be sealed after cloning. Hash values need to be computed during this cloning process. However, the cloned copy will be returned to the suspect for the deletion of LPP data before the investigator can work on the sanitized copy. Thus, the integrity of unmodified sectors has to be verified using the hash values computed based on the original hard disk. This paper found that existing schemes are not good enough to solve the integrity problem in the presence of both LSEs and deletion of LPP data. We then propose the idea of a “Dual Cube” hashing scheme to solve the problem. The experiments show the proposed scheme performs better than the previous schemes and fits easily into the digital forensic procedure.
Keywords :
computer forensics; cryptography; data integrity; hard discs; law administration; LPP data deletion; LPP integrity problem; data integrity; data storage; digital forensics; dual cube hashing scheme; hard disk; hard disk cloning process; hash per sector; latent sector errors; legal professional privileged data; single hash value; Cloning; Computer science; Digital forensics; Hard disks; Resource management; 3-Dimension Hashing; Combinatorial Group Testing (CGT); Hard Disk Sector Allocation; Latent Sector Errors (LSEs); Legal Professional Privilege (LPP);
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Systematic Approaches to Digital Forensic Engineering (SADFE), 2011 IEEE Sixth International Workshop on
Conference_Location :
Oakland, CA
Print_ISBN :
978-1-4673-1242-4
Type :
conf
DOI :
10.1109/SADFE.2011.1
Filename :
6159110
Link To Document :
بازگشت