University of New Orleans
Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations.
Degree: PhD, Computer Science, 2009, University of New Orleans
Digital forensics is the science concerned with discovering, preserving, and analyzing evidence on digital devices. The intent is to be able to determine what events have taken place, when they occurred, who performed them, and how they were performed. In order for an investigation to be effective, it must exhibit several characteristics. The results produced must be reliable, or else the theory of events based on the results will be flawed. The investigation must be comprehensive, meaning that it must analyze all targets which may contain evidence of forensic interest. Since any investigation must be performed within the constraints of available time, storage, manpower, and computation, investigative techniques must be efficient. Finally, an investigation must provide a coherent view of the events under question using the evidence gathered. Unfortunately the set of currently available tools and techniques used in digital forensic investigations does a poor job of supporting these characteristics. Many tools used contain bugs which generate inaccurate results; there are many types of devices and data for which no analysis techniques exist; most existing tools are woefully inefficient, failing to take advantage of modern hardware; and the task of aggregating data into a coherent picture of events is largely left to the investigator to perform manually. To remedy this situation, we developed a set of techniques to facilitate more effective investigations. To improve reliability, we developed the Forensic Discovery Auditing Module, a mechanism for auditing and enforcing controls on accesses to evidence. To improve comprehensiveness, we developed ramparser, a tool for deep parsing of Linux RAM images, which provides previously inaccessible data on the live state of a machine. To improve efficiency, we developed a set of performance optimizations, and applied them to the Scalpel file carver, creating order of magnitude improvements to processing speed and storage requirements. Last, to facilitate more coherent investigations, we developed the Forensic Automated Coherence Engine, which generates a high-level view of a system from the data generated by low-level forensics tools. Together, these techniques significantly improve the effectiveness of digital forensic investigations conducted using them.
Advisors/Committee Members: Richard III, Golden, Nino, Jaime, Roussev, Vassil.
Subjects/Keywords: Computer Forensics; Digital Forensics; Digital Investigation; File Carving; Live Forensics; RAM Forensics; Forensic Discovery; Forensic Discovery Auditing
to Zotero / EndNote / Reference
APA (6th Edition):
Marziale, L. (2009). Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations. (Doctoral Dissertation). University of New Orleans. Retrieved from https://scholarworks.uno.edu/td/1027
Chicago Manual of Style (16th Edition):
Marziale, Lodovico. “Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations.” 2009. Doctoral Dissertation, University of New Orleans. Accessed January 24, 2020.
MLA Handbook (7th Edition):
Marziale, Lodovico. “Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations.” 2009. Web. 24 Jan 2020.
Marziale L. Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations. [Internet] [Doctoral dissertation]. University of New Orleans; 2009. [cited 2020 Jan 24].
Available from: https://scholarworks.uno.edu/td/1027.
Council of Science Editors:
Marziale L. Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations. [Doctoral Dissertation]. University of New Orleans; 2009. Available from: https://scholarworks.uno.edu/td/1027