Difference between pages "File Carving Bibliography" and "Webloc"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
(New page: This is Mac OS X's internet shortcut file, similar to the Microsoft Windows .URL file. However, due to the heavy usage of AppleDouble resources, the expect...)
 
Line 1: Line 1:
; [http://citeseer.ist.psu.edu/shanmugasundaram03automatic.html Automatic Reassembly of Document Fragments via Context Based Statistical Models], Kulesh Shanmugasundaram and Nasir Memon.
+
This is Mac OS X's internet shortcut file, similar to the Microsoft Windows [[.URL]] fileHowever, due to the heavy usage of [[AppleDouble_header_file|AppleDouble]] resources, the expected data is actually stored as metadata and not in the the expected data file location.
  
<bibtex>
+
On the file system itself, the shortcut file named <code>News.webloc</code> pointing to <code>http://news.google.com</code> is actually a zero byte file. The URL is instead stored in the <code>._News.webloc</code> file in a field with resource type '<code>url </code>'.
@article{
+
  journal="Journal of Digital Forensic Practice", 
+
  publisher="Taylor & Francis",
+
  author="Yoginder Singh Dandass and Nathan Joseph Necaise and Sherry Reede Thomas",
+
  title="An Empirical Analysis of Disk Sector Hashes for Data Carving",
+
  year=2008,
+
  volume=2,
+
  issue=2,
+
  pages="95--106",
+
  abstract="Discovering known illicit material on digital storage devices is an important component of a digital forensic investigation. Using existing data carving techniques and tools, it is typically difficult to recover remaining fragments of deleted illicit files whose file system metadata and file headers have been overwritten by newer files. In such cases, a sector-based scan can be used to locate those sectors whose content matches those of sectors from known illicit files. However, brute-force sector-by-sector comparison is prohibitive in terms of time required. Techniques that compute and compare hash-based signatures of sectors in order to filter out those sectors that do not produce the same signatures as sectors from known illicit files are required for accelerating the process.
+
  
This article reports the results of a case study in which the hashes for over 528 million sectors extracted from over 433,000 files of different types were analyzed. The hashes were computed using SHA1, MD5, CRC64, and CRC32 algorithms and hash collisions of sectors from JPEG and WAV files to other sectors were recorded. The analysis of the results shows that although MD5 and SHA1 produce no false-positive indications, the occurrence of false positives is relatively low for CRC32 and especially CRC64. Furthermore, the CRC-based algorithms produce considerably smaller hashes than SHA1 and MD5, thereby requiring smaller storage capacities. CRC64 provides a good compromise between number of collisions and storage capacity required for practical implementations of sector-scanning forensic tools.",
+
[[Category:File Formats]]
  url="http://www.informaworld.com/10.1080/15567280802050436"
+
}
+
</bibtex>
+
 
+
[[Category:Bibliographies]]
+

Revision as of 04:24, 4 September 2008

This is Mac OS X's internet shortcut file, similar to the Microsoft Windows .URL file. However, due to the heavy usage of AppleDouble resources, the expected data is actually stored as metadata and not in the the expected data file location.

On the file system itself, the shortcut file named News.webloc pointing to http://news.google.com is actually a zero byte file. The URL is instead stored in the ._News.webloc file in a field with resource type 'url '.