You should do a final project that lets you learn something about Automated Document and Media Exploitation. Ideally the project will allow you to experiment with a new technology, learn something new and possibly work on an article that will be published. Who knows---you might even find an idea for your thesis.

Here are some technologies you might be interested in experimenting with:

• DRBD
• QEMU
• Crystalspace (has a python package)
• Crystalspace3d.org
• Processing.org
• PyPy and Psycho - make python run faster
• Zeitline, the Java Opensource Timeline editor
• Graphviz

Reverse Engineering

Easy

• Create a few plug-ins to bulk_extractor
• Create a compatible Bloom filter implementation in Java and benchmark it.
• Analyze the privacy and forensic properties of:
  • JFFS2
  • An SQL server (other than the ones in the SIGMMOD conference)
  • Microsoft's flash file system
• Make a substantive improvement to aimage. For example:
  • Fix the data recovery algorithm.
  • Give it a better GUI.
• DOMEX has played a critical role lately in attacks on the FARC in Columbia. Write a detailed paper about what's been done, what tools have been used, and what improvements you think could be made. Be sure to consider:
  • Interpol's Forensic Report on FARC Computers and Hardware.

Medium

• Add recursive processing of embedded objects to fiwalk
• Add file carving to fiwalk
• Integrate file permissions with sleuthkit
• Make the carver aware of the filesystem
• We have accidentally made multiple images of some of the media in the Real Data Corpus. Write a program that can find all the duplicates.
• We have some drives that were imaged, then they were changed a bit, then they were re-imaged. Write a program that nicely presents the differences include a high-level analysis.
• Here is the result of running bulk_extractor over the memory of Simson's Mac:

  nalin@redhat.com: 560
  dwalsh@redhat.com: 524
  bug-coreutils@gnu.org: 260
  katzj@redhat.com: 215
  jorton@redhat.com: 152
  mbarnes@redhat.com: 149
  jkeating@redhat.com: 136
  teg@redhat.com: 133
  jjohnstn@redhat.com: 116
  dcbw@redhat.com: 112
  dmalcolm@redhat.com: 98
  sopwith@redhat.com: 95
  G.@H.LK: 94
  pknirsch@redhat.com: 93
  than@redhat.com: 92
  harald@redhat.com: 91
  ezannoni@redhat.com: 86
  harald@redhat.de: 81
  mclasen@redhat.com: 77
  notting@redhat.com: 76
  timp@redhat.com: 69
  jnovy@redhat.com: 67
  misa@redhat.com: 67
  cturner@redhat.com: 66
  

  • Where are these email addresses coming from?
  • Can you write a program to automatically explain them?
  • Heck, can you explain them yourself?
  • Can you do this to your own memory?
• Write a program that automatically graphs email flows
  • Start->END
  • T1->T2

Hard

These projects are master's thesis level.

• Add support for JFFS2 or YAFFS to Sleuthkit
• Reverse engineer and report on the forensic properties of M-Systems FTL and NFTL flash drives (DiskOnChip)
• Automated Construction of realistic forensic scenarios.
• Produce a detailed report of a user's online activities from an examination of their hard drive. (Running system or disk image)
• Analyze the VeriSign (or DOD) CRLs for privacy leakage, analysis of what's being issued, and when.
• Add real-time sanitization of deleted files to a production operating system (Windows, FreeBSD, MacOS)
• Create an anti-spam system based on interview data
• Build an Advanced timeline visualization toolkit.