Domain-Specific Optimization In Digital Forensics - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2012

Domain-Specific Optimization In Digital Forensics

Abstract

File carvers are forensic software tools used to recover data from storage devices in order to find evidence. Every legal case requires different trade-offs between precision and runtime performance. The resulting required changes to the software tools are performed manually and under the strictest deadlines. In this paper we present a model-driven approach to file carver development that enables these trade-offs to be automated. By transforming high-level file format specifications into approximations that are more permissive, forensic investigators can trade precision for performance, without having to change source. Our study shows that performance gains up to a factor of three can be achieved, at the expense of up to 8% in precision and 5% in recall.

Dates and versions

hal-00756891 , version 1 (23-11-2012)

Identifiers

Cite

Jeroen van den Bos, Tijs van Der Storm. Domain-Specific Optimization In Digital Forensics. ICMT 2012 - 5th International Conference on Theory and Practice of Model Transformations, May 2012, Prague, Czech Republic. pp.121 - 136, ⟨10.1007/978-3-642-30476-7_8⟩. ⟨hal-00756891⟩

Collections

INRIA INRIA2
47 View
0 Download

Altmetric

Share

Gmail Facebook X LinkedIn More