Bibliography - Revision history

Simsong at 01:05, 29 August 2008

2008-08-29T01:05:58Z

Simsong at 01:02, 29 August 2008

2008-08-29T01:02:06Z

Simsong at 01:01, 29 August 2008

2008-08-29T01:01:37Z

Simsong: /* File Carving */

2008-07-05T23:33:40Z

‎File Carving

Simsong: /* Feature Extraction and Data Fusion */

2008-07-05T23:30:07Z

‎Feature Extraction and Data Fusion

Simsong: /* Feature Extraction and Data Fusion */

2008-05-30T17:06:05Z

‎Feature Extraction and Data Fusion

Simsong: /* Disk Disposal and Data Recovery */

2008-05-30T17:04:14Z

‎Disk Disposal and Data Recovery

Simsong: /* Disk Disposal and Data Recovery */

2008-05-30T17:03:03Z

‎Disk Disposal and Data Recovery

Simsong at 17:01, 30 May 2008

2008-05-30T17:01:19Z

Simsong at 16:59, 30 May 2008

2008-05-30T16:59:31Z

← Older revision		Revision as of 01:05, 29 August 2008
Line 84:		Line 84:
	* [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 A Model for When Disclosure Helps Security: What is Different About Computer and Network Security?], Peter P. Swire, Moritz College of Law of the Ohio State University, Journal on Telecommunications and High Technology Law, Vol. 2, 2004.		* [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 A Model for When Disclosure Helps Security: What is Different About Computer and Network Security?], Peter P. Swire, Moritz College of Law of the Ohio State University, Journal on Telecommunications and High Technology Law, Vol. 2, 2004.

−	[[Category::Bibliographies]]	+	[[Category:Bibliographies]]

@@ Line 41: / Line 41: @@
    url="http://www.dfrws.org/2006/proceedings/10-Garfinkel.pdf",
    location="Lafayette, Indiana"
+}
 </bibtex>

← Older revision		Revision as of 01:01, 29 August 2008
Line 105:		Line 105:

	* [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 A Model for When Disclosure Helps Security: What is Different About Computer and Network Security?], Peter P. Swire, Moritz College of Law of the Ohio State University, Journal on Telecommunications and High Technology Law, Vol. 2, 2004.		* [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 A Model for When Disclosure Helps Security: What is Different About Computer and Network Security?], Peter P. Swire, Moritz College of Law of the Ohio State University, Journal on Telecommunications and High Technology Law, Vol. 2, 2004.
		+
		+	[[Category::Bibliographies]]

← Older revision		Revision as of 23:33, 5 July 2008
Line 46:		Line 46:
	=File Carving=		=File Carving=

−	* [http://citeseer.ist.psu.edu/shanmugasundaram03automatic.html Automatic Reassembly of Document Fragments via Context Based Statistical Models], Kulesh Shanmugasundaram and Nasir Memon.

		+	* [http://citeseer.ist.psu.edu/shanmugasundaram03automatic.html Automatic Reassembly of Document Fragments via Context Based Statistical Models], Kulesh Shanmugasundaram and Nasir Memon.
		+
		+	<bibtex>
		+	@article{
		+	journal="Journal of Digital Forensic Practice",
		+	publisher="Taylor & Francis",
		+	author="Yoginder Singh Dandass and Nathan Joseph Necaise and Sherry Reede Thomas",
		+	title="An Empirical Analysis of Disk Sector Hashes for Data Carving",
		+	year=2008,
		+	volume=2,
		+	issue=2,
		+	pages="95--106",
		+	abstract="Discovering known illicit material on digital storage devices is an important component of a digital forensic investigation. Using existing data carving techniques and tools, it is typically difficult to recover remaining fragments of deleted illicit files whose file system metadata and file headers have been overwritten by newer files. In such cases, a sector-based scan can be used to locate those sectors whose content matches those of sectors from known illicit files. However, brute-force sector-by-sector comparison is prohibitive in terms of time required. Techniques that compute and compare hash-based signatures of sectors in order to filter out those sectors that do not produce the same signatures as sectors from known illicit files are required for accelerating the process.
		+
		+	This article reports the results of a case study in which the hashes for over 528 million sectors extracted from over 433,000 files of different types were analyzed. The hashes were computed using SHA1, MD5, CRC64, and CRC32 algorithms and hash collisions of sectors from JPEG and WAV files to other sectors were recorded. The analysis of the results shows that although MD5 and SHA1 produce no false-positive indications, the occurrence of false positives is relatively low for CRC32 and especially CRC64. Furthermore, the CRC-based algorithms produce considerably smaller hashes than SHA1 and MD5, thereby requiring smaller storage capacities. CRC64 provides a good compromise between number of collisions and storage capacity required for practical implementations of sector-scanning forensic tools.",
		+	url="http://www.informaworld.com/10.1080/15567280802050436"
		+	}
		+	</bibtex>

	=Text Mining=		=Text Mining=

@@ Line 30: / Line 30: @@
 Extracted Features
 http://www2.chadsteel.com:8080/Publications/drive_location2.doc
+<bibtex>
 @inproceedings{garfinkel:cda,
    title="Forensic feature extraction and cross-drive analysis",
@@ Line 42: / Line 42: @@
    location="Lafayette, Indiana"
+}
 =File Carving=

← Older revision		Revision as of 17:06, 30 May 2008
Line 31:		Line 31:
	http://www2.chadsteel.com:8080/Publications/drive_location2.doc		http://www2.chadsteel.com:8080/Publications/drive_location2.doc

		+	@inproceedings{garfinkel:cda,
		+	title="Forensic feature extraction and cross-drive analysis",
		+	author="Simson Garfinkel",
		+	booktitle={Proceedings of the 6th Annual Digital Forensic Research Workshop (DFRWS)},
		+	address = "Lafayette, Indiana",
		+	journal="Digital Investigation",
		+	year=2006,
		+	month=Aug,
		+	url="http://www.dfrws.org/2006/proceedings/10-Garfinkel.pdf",
		+	location="Lafayette, Indiana"
		+	}

	=File Carving=		=File Carving=

@@ Line 13: / Line 13: @@
    publisher =    "IEEE",
    year      =         "2002",
-   month     = Jan
+   month     = Jan,
+}
 </bibtex>

@@ Line 4: / Line 4: @@
 * [[Recovering Overwritten Data#The Gutmann Paper|Secure Deletion of Data from Magnetic and Solid-State Memory]], Peter Gutmann, Proceedings of the Sixth Usenix Security Symposium, 1996. [http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html]
 * [http://www-03.ibm.com/financing/pdf/us/recovery/igf4-a032.pdf Hard Drive Disposal: The Overlooked Confidentiality Exposure], FInancial Perspectives, IBM White Paper, November 2003.
 =Evidence Gathering=

@@ Line 23: / Line 23: @@
 * [http://citeseer.ist.psu.edu/shanmugasundaram03automatic.html  Automatic Reassembly of Document Fragments via Context Based Statistical Models], Kulesh Shanmugasundaram and Nasir Memon.
 =Signed Evidence=
@@ Line 51: / Line 55: @@
+}
 </bibtex>
 =Other Papers=
 * [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782 A Model for When Disclosure Helps Security: What is Different About Computer and Network Security?], Peter P. Swire, Moritz College of Law of the Ohio State University, Journal on Telecommunications and High Technology Law, Vol. 2, 2004.

← Older revision		Revision as of 16:59, 30 May 2008
Line 12:		Line 12:

	* [https://analysis.mitre.org/proceedings/Final_Papers_Files/84_Camera_Ready_Paper.pdf Automatic Detection of Fake File Systems], Neil C. Rowe, International Conference on Intelligence Analysis Methods and Tools, McLean, Virginia, May 2005.		* [https://analysis.mitre.org/proceedings/Final_Papers_Files/84_Camera_Ready_Paper.pdf Automatic Detection of Fake File Systems], Neil C. Rowe, International Conference on Intelligence Analysis Methods and Tools, McLean, Virginia, May 2005.
		+
		+	=Feature Extraction and Data Fusion=
		+	Computer Location Determination Through Geoparsing and Geocoding of
		+	Extracted Features
		+	http://www2.chadsteel.com:8080/Publications/drive_location2.doc
		+

	=File Carving=		=File Carving=