Find results with:

Add another field

Search by date

to

Searching collections:

University of New Orleans Electronic Theses and Dissertations

Add or remove collections

Home Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations

Reference URL

Share

Add tags

Comment

Rate

To link to this object, paste this link in email, IM or document

To embed this object, paste this HTML in website

Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations

View Description

Download

small (250x250 max)

medium (500x500 max)

large ( > 500x500)

Full Resolution

Print

you wish to report:

Your comment:

Your Name:

Submit

Cancel

...

Back to top

Powered by CONTENTdm®

Contact Information	Please send any questions regarding this item to libref@uno.edu
Title	Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations
Author	Marziale, Lodovico
Document Type	Dissertation
Keywords	Computer Forensics, Digital Forensics, Digital Investigation, File Carving, Live Forensics, RAM Forensics, Forensic Discovery, Forensic Discovery Auditing
Abstract	Digital forensics is the science concerned with discovering, preserving, and analyzing evidence on digital devices. The intent is to be able to determine what events have taken place, when they occurred, who performed them, and how they were performed. In order for an investigation to be effective, it must exhibit several characteristics. The results produced must be reliable, or else the theory of events based on the results will be flawed. The investigation must be comprehensive, meaning that it must analyze all targets which may contain evidence of forensic interest. Since any investigation must be performed within the constraints of available time, storage, manpower, and computation, investigative techniques must be efficient. Finally, an investigation must provide a coherent view of the events under question using the evidence gathered. Unfortunately the set of currently available tools and techniques used in digital forensic investigations does a poor job of supporting these characteristics. Many tools used contain bugs which generate inaccurate results; there are many types of devices and data for which no analysis techniques exist; most existing tools are woefully inefficient, failing to take advantage of modern hardware; and the task of aggregating data into a coherent picture of events is largely left to the investigator to perform manually. To remedy this situation, we developed a set of techniques to facilitate more effective investigations. To improve reliability, we developed the Forensic Discovery Auditing Module, a mechanism for auditing and enforcing controls on accesses to evidence. To improve comprehensiveness, we developed ramparser, a tool for deep parsing of Linux RAM images, which provides previously inaccessible data on the live state of a machine. To improve efficiency, we developed a set of performance optimizations, and applied them to the Scalpel file carver, creating order of magnitude improvements to processing speed and storage requirements. Last, to facilitate more coherent investigations, we developed the Forensic Automated Coherence Engine, which generates a high-level view of a system from the data generated by low-level forensics tools. Together, these techniques significantly improve the effectiveness of digital forensic investigations conducted using them.
Access	Unrestricted
Degree	Ph. D.
Degree Program	Engineering and Applied Science
Department	Dept. of Computer Science
Major Professor	Richard III, Golden
Advisory Committee	Nino, Jaime; Roussev, Vassil; Ioup, Juliette; Bourgeois, Edit
Date Degree Awarded	2009-12-20
Format	PDF
URL	See 'reference url' on top or bottom navigation bars.
Rights	The University of New Orleans and its agents retain the non-exclusive license to archive and make accessible this dissertation or thesis in whole or in part in all forms of media, now or hereafter known. The author retains all other ownership rights to the copyright of the thesis or dissertation.
Catalog Date	2010-01-02
Object File Name	2009_PhD_Marziale_Lodovico
Viewer Information	Adobe Reader required for viewing (http://www.adobe.com/products/acrobat/readermain.html)
Rating

Find results with:

Searching collections:

Home Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations

Advanced Techniques for Improving the Efficacy of Digital Forensics Investigations

Description

Tags

Comments