Fast Disk Analysis with Random Sampling
Dr. Simson Garfinkel, NPS

In Fast Disk Analysis with Random Sampling, a new method for rapidly characterizing the forensic contents of a hard drive or other storage devices using random sampling will be presented. Using this method, it is possible to rapidly determine with a high degree of confidence whether or not large storage devices have been properly cleared of data from previous use. Next, we shall show how the method can be extended to characterize the kind of information stored on a storage device through a combination of statistical sampling and file fragment identification. We shall present highly accurate file fragment identifiers developed using a new technique that employs grid search runs on a medium-sized cluster to tune algorithms developed by hand using introspection. Finally, we shall present real-world applications of this technology to identify the percentage of images and encrypted data stored on a 160GB Apple iPod in less than two minutes.

close window ]