Verifying the integrity of a hard disk is an important concern in computer forensics,as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation.A t...Verifying the integrity of a hard disk is an important concern in computer forensics,as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation.A typical approach is to compute a single chained hash value of all sectors in a specific order.However,this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified intentionally.In this paper we propose a k-dimensional hashing scheme,kD for short,to distribute sectors into a kD space,and to calculate multiple hash values for sectors in k dimensions as integrity evidence.Since the integrity of the sectors can be verified depending on any hash value calculated using the sectors,the probability to verify the integrity of unchanged sectors can be high even with bad/modified sectors in the hard disk.We show how to efficiently implement this kD hashing scheme such that the storage of hash values can be reduced while increasing the chance of an unaffected sector to be verified successfully.Experimental results of a 3D scheme show that both the time for computing the hash values and the storage for the hash values are reasonable.展开更多
基金Project supported by the Research Grants Council of Hong Kong SAR,China (No. RGC GRF HKU 713009E)the NSFC/RGC Joint Research Scheme (No. N_HKU 722/09)HKU Seed Fundings for Basic Research (Nos. 200811159155 and 200911159149)
文摘Verifying the integrity of a hard disk is an important concern in computer forensics,as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation.A typical approach is to compute a single chained hash value of all sectors in a specific order.However,this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified intentionally.In this paper we propose a k-dimensional hashing scheme,kD for short,to distribute sectors into a kD space,and to calculate multiple hash values for sectors in k dimensions as integrity evidence.Since the integrity of the sectors can be verified depending on any hash value calculated using the sectors,the probability to verify the integrity of unchanged sectors can be high even with bad/modified sectors in the hard disk.We show how to efficiently implement this kD hashing scheme such that the storage of hash values can be reduced while increasing the chance of an unaffected sector to be verified successfully.Experimental results of a 3D scheme show that both the time for computing the hash values and the storage for the hash values are reasonable.
