Big Digital Forensic Data: Volume 1: Data Reduction Framework and Selective Imaging

In: SpringerBriefs on Cyber Security Systems and Networks Ser.

Abstract

Intro -- Foreword -- Preface -- Acknowledgements -- Contents -- Abbreviations -- Keywords -- 1 Introduction -- References -- 2 Background and Literature Review -- 2.1 Background -- 2.2 Volume of Data -- 2.3 Growth of Media -- 2.4 Processing Time -- 2.5 Proposed Solutions -- 2.5.1 Data Mining -- 2.5.2 Data Reduction and Subsets -- 2.5.3 Triage -- 2.6 Other Proposed Solutions to the Data Volume Challenge -- 2.7 Discussion -- 2.8 Summary -- References -- 3 Data Reduction and Data Mining Frame-Work -- 3.1 Motivation -- 3.2 Proposed Digital Forensic Data Reduction and Data Mining Framework -- 3.3 Pilot Study Preliminary Findings -- 3.4 Discussion -- 3.5 Summary -- References -- 4 Digital Forensic Data Reduction by Selective Imaging -- 4.1 Digital Forensic Data Reduction by Selective Imaging -- 4.1.1 Load or Mount Forensic Image or Connect Physical Device -- 4.1.2 Processing Options -- 4.1.3 Filters for Subset Files -- 4.1.4 File System Filters -- 4.1.5 Operating System Filters -- 4.1.6 Software and Applications Filters -- 4.1.7 User Data Filters -- 4.1.8 Review of Large Files -- 4.1.9 Excluded File Types and Overwritten Files and Data -- 4.1.10 File and Data List (Spreadsheet) Report -- 4.1.11 Video Thumbnails Method -- 4.1.12 Picture Dimension Reduction -- 4.1.13 Preservation -- 4.2 Test Data Application and Results -- 4.3 Application to Real World Digital Forensic Case Data -- 4.3.1 Real World Data Subset Reduction -- 4.3.2 Real World Data-Video Thumbnailing -- 4.3.3 Real World Data-Case Examples and Post Case Analysis -- 4.3.4 Real World Data-Cross Case Analysis -- 4.3.5 Real World Data-Failing Hard Disk Drives -- 4.4 Discussion -- 4.5 Summary -- References -- 5 Summary of the Framework and DRbSI -- 5.1 Conclusion -- References.