Difference between revisions of "2009-08-20 Talk"

From Simson Garfinkel
Jump to navigationJump to search
m
m
Line 1: Line 1:
<big>Automated Digital Forensics and Media Exploitation</big>
<big>Automated Digital Forensics and Media Exploitation</big>
==Abstract==  
==Abstract==  
Digital Forensics seeks to find, preserve, and present information found inside computer systems and provide causative explanations for the reason that the information is there. Today digital forensics is largely done by highly trained practitioners using data recovery tools that can search for deleted files, examine swap space, and decrypt encrypted file systems.  
Despite what you may have seen in the movies, today the primary use of digital forensics is to demonstrate the presence of child pornography on the computer systems of suspected criminal perpetrators. Although digital forensics has a great potential for providing criminal leads and assisting in criminal investigations, there is a nationwide shortage of  forensic investigators and today's tools are incredibly difficult to use.


This talk presents new research in Automated Digital Forensics---our effort to apply the tools of data mining, statistics and artificial intelligence to the problems of digital forensics. The ultimate goal of this research is to develop batch  processing tools that will be able to ingest a hard drive or flash storage device and produce a high-level reports that automatically make discoveries about the media that are useful for investigations.
This talk presents research aimed at realizing the dream of Automated Digital Forensics---research that brings the tools of data mining and artificial intelligence to the problems of digital forensics. The ultimate goal of this research is to automated tools that will be able to ingest a hard drive or flash storage device and produce a high-level reports that be productively used by relatively untrained individuals.


Starting with a quick introduction to the field of digital forensics, this talk will then present three major research efforts:
Starting with a quick introduction to the field of digital forensics, this talk will then present three research initiatives:
# '''Cross-Drive Analysis,''' our work on tools and algorithms that can automatically detect which hard drives in a collection were previously used by members of terrorist networks, and which drives belong to the "background."
# '''Multi-User Carved Data Ascription,''' a new technique that allows data ''carved'' from the hard drive of a multi-user computer system to be attributed with a high degree of accuracy to one of the computer's former users.
# '''Instant Drive Analysis,''' our work which allows the contents of a 1TB hard drive to be analyzed in less than 45 seconds using statistical sampling.
# '''Instant Drive Analysis,''' our work which allows the contents of a 1TB hard drive to be inventoried in less than 45 seconds using statistical sampling.
# Our efforts to build '''Standardized Forensic Corpora''' of files and disk images, so that work in this area done by different practitioners can be scientifically compared.
# Our efforts to build '''Standardized Forensic Corpora''' of files and disk images, so that work different practitioners can be scientifically compared.


==Bio==
==Bio==


Simson L. Garfinkel is an Associate Professor at the Naval Postgraduate School in Monterey, California, and an associate of the School of Engineering and Applied Sciences at Harvard University. His research interests include computer forensics, the emerging field of usability and security, personal information management, privacy, information policy and terrorism.
Simson L. Garfinkel is an Associate Professor at the Naval Postgraduate School in Monterey, California. His current research interests include computer forensics, the emerging field of usability and security, the impact of federal human subject laws and regulations on computer science research, information policy and terrorism.


Garfinkel is the author or co-author of fourteen books on computing. He is perhaps best known for his bookDatabase Nation: The Death of Privacy in the 21st Century. Garfinkel's most successful book, Practical UNIX and Internet Security (co-authored with Gene Spafford), has sold more than 250,000 copies and been translated into more than a dozen languages since the first edition was published in 1991.
Garfinkel is the author or co-author of fourteen books on computing. He is perhaps best known for his book Database Nation: The Death of Privacy in the 21st Century. Garfinkel's most successful book, Practical UNIX and Internet Security (co-authored with Gene Spafford), has sold more than 250,000 copies and been translated into more than a dozen languages since the first edition was published in 1991.


Simson Garfinkel received three Bachelor of Science degrees from MIT in 1987, a Master's of Science in Journalism from Columbia University in 1988, and a Ph.D. in Computer Science from MIT in 2005.
Simson Garfinkel received three Bachelor of Science degrees from MIT in 1987, a Master's of Science in Journalism from Columbia University in 1988, and a Ph.D. in Computer Science from MIT in 2005.

Revision as of 23:52, 12 August 2009

Automated Digital Forensics and Media Exploitation

Abstract

Despite what you may have seen in the movies, today the primary use of digital forensics is to demonstrate the presence of child pornography on the computer systems of suspected criminal perpetrators. Although digital forensics has a great potential for providing criminal leads and assisting in criminal investigations, there is a nationwide shortage of forensic investigators and today's tools are incredibly difficult to use.

This talk presents research aimed at realizing the dream of Automated Digital Forensics---research that brings the tools of data mining and artificial intelligence to the problems of digital forensics. The ultimate goal of this research is to automated tools that will be able to ingest a hard drive or flash storage device and produce a high-level reports that be productively used by relatively untrained individuals.

Starting with a quick introduction to the field of digital forensics, this talk will then present three research initiatives:

  1. Multi-User Carved Data Ascription, a new technique that allows data carved from the hard drive of a multi-user computer system to be attributed with a high degree of accuracy to one of the computer's former users.
  2. Instant Drive Analysis, our work which allows the contents of a 1TB hard drive to be inventoried in less than 45 seconds using statistical sampling.
  3. Our efforts to build Standardized Forensic Corpora of files and disk images, so that work different practitioners can be scientifically compared.

Bio

Simson L. Garfinkel is an Associate Professor at the Naval Postgraduate School in Monterey, California. His current research interests include computer forensics, the emerging field of usability and security, the impact of federal human subject laws and regulations on computer science research, information policy and terrorism.

Garfinkel is the author or co-author of fourteen books on computing. He is perhaps best known for his book Database Nation: The Death of Privacy in the 21st Century. Garfinkel's most successful book, Practical UNIX and Internet Security (co-authored with Gene Spafford), has sold more than 250,000 copies and been translated into more than a dozen languages since the first edition was published in 1991.

Simson Garfinkel received three Bachelor of Science degrees from MIT in 1987, a Master's of Science in Journalism from Columbia University in 1988, and a Ph.D. in Computer Science from MIT in 2005.

Talk Details

See Also

Retrieved from "https://simson.net/wiki/index.php?title=2009-08-20_Talk&oldid=428"