Using Approximate Matching to Reduce the Volume of Digital Data - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2014

Using Approximate Matching to Reduce the Volume of Digital Data

Résumé

Digital forensic investigators frequently have to search for relevant files in massive digital corpora – a task often compared to finding a needle in a haystack. To address this challenge, investigators typically apply cryptographic hash functions to identify known files. However, cryptographic hashing only allows the detection of files that exactly match the known file hash values or fingerprints. This paper demonstrates the benefits of using approximate matching to locate relevant files. The experiments described in this paper used three test images of Windows XP, Windows 7 and Ubuntu 12.04 systems to evaluate fingerprint-based comparisons. The results reveal that approximate matching can improve file identification – in one case, increasing the identification rate from 1.82% to 23.76%.
Fichier principal
Vignette du fichier
978-3-662-44952-3_11_Chapter.pdf (1022.23 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01393769 , version 1 (08-11-2016)

Licence

Paternité

Identifiants

Citer

Frank Breitinger, Christian Winter, York Yannikos, Tobias Fink, Michael Seefried. Using Approximate Matching to Reduce the Volume of Digital Data. 10th IFIP International Conference on Digital Forensics (DF), Jan 2014, Vienna, Austria. pp.149-163, ⟨10.1007/978-3-662-44952-3_11⟩. ⟨hal-01393769⟩
140 Consultations
145 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More