High Speed Bitwise Search for Digital Forensic System

The most common forensic activity is searching a hard disk for string of data. Nowadays, investigators and analysts are increasingly experiencing large, even terabyte sized data sets when conducting digital investigations. Therefore consecutive searching can take weeks to complete successfully. There are two primary search methods: index-based search and bitwise search. Index-based searching is very fast after the initial indexing but initial indexing takes a long time. In this paper, we discuss a high speed bitwise search model for large-scale digital forensic investigations. We used pattern matching board, which is generally used for network security, to search for string and complex regular expressions. Our results indicate that in many cases, the use of pattern matching board can substantially increase the performance of digital forensic search tools.

Authors:

• Hyungkeun Jee
• Jooyoung Lee
• Dowon Hong

Keywords:

• Digital forensics
• search
• regular expression.

References:

[1] Beebe NL, Dietrich G., "A new process model for text string searching,"
Research advances in digital forensics III. Norwell: Springer, 2007, pp.
73-85.
[2] Baeza-Yates, R., String searching algorithms. In information Retrieval:
Algorithms and Data Structures, Chap. 10, W. Frakes and R.
Baeza-Yates, Eds., Prentice Hall, Englewood Cliffs, N.J.m 1992, pp.
219-240.
[3] E. Casey, Handbook of Computer Crime Investigation: Forensic Tools
and Technology, Academic Press, San Diego, California, 2002.
[4] Brian Carrier, File System Forensic Analysis, Pearson Education, Inc.,
2005.
[5] Nicole Lang Beebe, Jan Guynes Clark, "Digital forensic text string
searching," Proceedings of the 2007 digital forensics research workshop
(DFRWS 2007), pp. 49-54.
[6] Chad Steel, Windows Forensics, Wiley Publishing, Inc. 2006.
[7] W. B. Frakes and R. Baeza-Yates, Information Retrieval: Data Structure
& Algorithms, Prentice Hall, 1992.
[8] Kukich K., "Techniques for Automatically Correcting Words in Text,"
ACM Computing Surveys, vol. 24, No. 4, 1992, pp. 377-440.
[9] Tarari. Available: http://www.tarari.com