2009-08-20 Talk

Automated Digital Forensics and Media Exploitation (slides)

Abstract

Despite what you may have seen in the movies, today the primary use of digital forensics is to demonstrate the presence of child pornography on the computer systems of suspected criminal perpetrators. Although digital forensics has a great potential for providing criminal leads and assisting in criminal investigations, there is a nationwide shortage of forensic investigators and today's tools are incredibly difficult to use.

This talk presents research aimed at realizing the dream of Automated Digital Forensics---research that brings the tools of data mining and artificial intelligence to the problems of digital forensics. The ultimate goal of this research is to create automated tools that will be able to ingest a hard drive or flash storage device and produce a high-level reports that be productively used by relatively untrained individuals.

Starting with a quick introduction to the field of digital forensics, this talk will then present three research initiatives:

1. Multi-User Carved Data Ascription, a new technique that allows data carved from the hard drive of a multi-user computer system to be attributed with a high degree of accuracy to one of the computer's former users.
2. Instant Drive Analysis, our work which allows the contents of a 1TB hard drive to be inventoried in less than 45 seconds using statistical sampling.
3. Our efforts to build Standardized Forensic Corpora of files and disk images, so that work different practitioners can be scientifically compared.

Many of the tools and much of the data that we will discuss can be downloaded from the author's websites at http://afflib.org/ and http://digitalcorpora.org/.

Bio

Simson L. Garfinkel is an Associate Professor at the Naval Postgraduate School in Monterey, California. His current research interests include computer forensics, the emerging field of usability and security, the impact of federal human subject laws and regulations on computer science research, information policy and terrorism.

Garfinkel is the author or co-author of fourteen books on computing. He is perhaps best known for his book Database Nation: The Death of Privacy in the 21st Century. Garfinkel's most successful book, Practical UNIX and Internet Security (co-authored with Gene Spafford), has sold more than 250,000 copies and been translated into more than a dozen languages since the first edition was published in 1991.

Simson Garfinkel received three Bachelor of Science degrees from MIT in 1987, a Master's of Science in Journalism from Columbia University in 1988, and a Ph.D. in Computer Science from MIT in 2005.

Talk Details

• August 20 3:00pm, MIT CSAIL, in 32-G449 (CSAIL Kiva)

See Also

• Automated Document and Media Exploitation
  • Sub-Linear Drive Analysis
  • The Real Data Corpus: Building an open research corpora of disk images from around the world.