Please wait a minute...
Front. Inform. Technol. Electron. Eng.  2011, Vol. 12 Issue (10): 809-818    DOI: 10.1631/jzus.C1000425
    
k-Dimensional hashing scheme for hard disk integrity verification in computer forensics
Zoe Lin Jiang1,2, Jun-bin Fang*,2, Lucas Chi Kwong Hui2, Siu Ming Yiu2, Kam Pui Chow2, Meng-meng Sheng2
1 School of Computer Science and Technology, Harbin Institute of Technology Shenzhen Graduate School, Shenzhen 518055, China 2 Department of Computer Science, The University of Hong Kong, Hong Kong, China
Download:   PDF(444KB)
Export: BibTeX | EndNote (RIS)      

Abstract  Verifying the integrity of a hard disk is an important concern in computer forensics, as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation. A typical approach is to compute a single chained hash value of all sectors in a specific order. However, this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified intentionally. In this paper we propose a k-dimensional hashing scheme, kD for short, to distribute sectors into a kD space, and to calculate multiple hash values for sectors in k dimensions as integrity evidence. Since the integrity of the sectors can be verified depending on any hash value calculated using the sectors, the probability to verify the integrity of unchanged sectors can be high even with bad/modified sectors in the hard disk. We show how to efficiently implement this kD hashing scheme such that the storage of hash values can be reduced while increasing the chance of an unaffected sector to be verified successfully. Experimental results of a 3D scheme show that both the time for computing the hash values and the storage for the hash values are reasonable.

Key wordsComputer forensics      Digital evidence      Hard disk integrity      k-Dimensional hashing     
Received: 11 December 2010      Published: 08 October 2011
CLC:  TP309  
Cite this article:

Zoe Lin Jiang, Jun-bin Fang, Lucas Chi Kwong Hui, Siu Ming Yiu, Kam Pui Chow, Meng-meng Sheng. k-Dimensional hashing scheme for hard disk integrity verification in computer forensics. Front. Inform. Technol. Electron. Eng., 2011, 12(10): 809-818.

URL:

http://www.zjujournals.com/xueshu/fitee/10.1631/jzus.C1000425     OR     http://www.zjujournals.com/xueshu/fitee/Y2011/V12/I10/809


k-Dimensional hashing scheme for hard disk integrity verification in computer forensics

Verifying the integrity of a hard disk is an important concern in computer forensics, as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation. A typical approach is to compute a single chained hash value of all sectors in a specific order. However, this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified intentionally. In this paper we propose a k-dimensional hashing scheme, kD for short, to distribute sectors into a kD space, and to calculate multiple hash values for sectors in k dimensions as integrity evidence. Since the integrity of the sectors can be verified depending on any hash value calculated using the sectors, the probability to verify the integrity of unchanged sectors can be high even with bad/modified sectors in the hard disk. We show how to efficiently implement this kD hashing scheme such that the storage of hash values can be reduced while increasing the chance of an unaffected sector to be verified successfully. Experimental results of a 3D scheme show that both the time for computing the hash values and the storage for the hash values are reasonable.

关键词: Computer forensics,  Digital evidence,  Hard disk integrity,  k-Dimensional hashing 
[1] Ehsan Saeedi, Yinan Kong, Md. Selim Hossain. Side-channel attacks and learning-vector quantization[J]. Front. Inform. Technol. Electron. Eng., 2017, 18(4): 511-518.
[2] Yu-jun Xiao, Wen-yuan Xu, Zhen-hua Jia, Zhuo-ran Ma, Dong-lian Qi. NIPAD: a non-invasive power-based anomaly detection scheme for programmable logic controllers[J]. Front. Inform. Technol. Electron. Eng., 2017, 18(4): 519-534.
[3] Gaurav Bansod, Narayan Pisharoty, Abhijit Patil. BORON: an ultra-lightweight and low power encryption design for pervasive computing[J]. Front. Inform. Technol. Electron. Eng., 2017, 18(3): 332-345.
[4] Feng-he Wang, Chun-xiao Wang, Zhen-hua Liu. Efficient hierarchical identity based encryption scheme in the standard model over lattices[J]. Front. Inform. Technol. Electron. Eng., 2016, 17(8): 781-791.
[5] Jia Xie, Yu-pu Hu, Jun-tao Gao, Wen Gao. Efficient identity-based signature over NTRU lattice[J]. Front. Inform. Technol. Electron. Eng., 2016, 17(2): 135-142.
[6] Kok-Seng Wong, Myung Ho Kim. Towards a respondent-preferred ki-anonymity model[J]. Front. Inform. Technol. Electron. Eng., 2015, 16(9): 720-731.
[7] Kuo-Hui Yeh. A lightweight authentication scheme with user untraceability[J]. Front. Inform. Technol. Electron. Eng., 2015, 16(4): 259-271.
[8] Osama A. Khashan, Abdullah M. Zin, Elankovan A. Sundararajan. ImgFS: a transparent cryptography for stored images using a filesystem in userspace[J]. Front. Inform. Technol. Electron. Eng., 2015, 16(1): 28-42.
[9] Shuang Tan, Yan Jia. NaEPASC: a novel and efficient public auditing scheme for cloud data[J]. Front. Inform. Technol. Electron. Eng., 2014, 15(9): 794-804.
[10] Osama A. Khashan, Abdullah M. Zin, Elankovan A. Sundararajan. Performance study of selective encryption in comparison to full encryption for still visual images[J]. Front. Inform. Technol. Electron. Eng., 2014, 15(6): 435-444.
[11] Kuo-Hui Yeh, Kuo-Yu Tsai, Jia-Li Hou. Analysis and design of a smart card based authentication protocol[J]. Front. Inform. Technol. Electron. Eng., 2013, 14(12): 909-917.
[12] Yong Cheng, Zhi-ying Wang, Jun Ma, Jiang-jiang Wu, Song-zhu Mei, Jiang-chun Ren. Efficient revocation in ciphertext-policy attribute-based encryption based cryptographic cloud storage[J]. Front. Inform. Technol. Electron. Eng., 2013, 14(2): 85-97.
[13] Hong-yuan Chen, Yue-sheng Zhu. A robust watermarking algorithm based on QR factorization and DCT using quantization index modulation technique[J]. Front. Inform. Technol. Electron. Eng., 2012, 13(8): 573-584.
[14] Baiying Lei, Ing Yann Soon. A multipurpose audio watermarking algorithm with synchronization and encryption[J]. Front. Inform. Technol. Electron. Eng., 2012, 13(1): 11-19.
[15] Yang Yang, Yu-pu Hu, Le-you Zhang, Chun-hui Sun. CCA2 secure biometric identity based encryption with constant-size ciphertext[J]. Front. Inform. Technol. Electron. Eng., 2011, 12(10): 819-827.