IMPROVED UNINSTALLED APPLICATION INFERENCE THROUGH MORE ACCURATE CATALOG CONSTRUCTION AND CONSIDERATION OF FILE SYSTEM BEHAVIOR

Digital Forensics investigations are often limited when digital artifacts have been intentionally or inadvertently deleted and fully or partially overwritten. Current approaches for dealing with deleted or partially overwritten artifacts attempt to recover or infer artifact presence through file signature matching, file carving, fragment analysis, and data structure analysis. Prior work for inferring the past presence of a now uninstalled software application matches sectors from a digital media image to a catalog of known multi-file artifact sector sets associated with specific software applications. This approach is limited by the occurrence of false positive sector matches. In this dissertation, I address this limitation in several ways. First, I collect a more accurate set of relevant artifacts by adapting the sequential snapshot file differencing method to identify and eliminate from the catalog filesystem changes which are not due to application installation and use. In addition to improved catalog construction, I add consideration of the relative locations of the matched sectors, where relative refers to matching sector alignment relative to the original file of interest and cluster boundaries. I also add exponential weighting for file matches based on other work suggesting that the additional inferential value of each matching sector declines as more sectors are matched. Finally, I develop a sector adjacency weighting method whereby I codify the intuition that an apparent application file remnant is more likely to be from the file of interest if we observe a run of contiguous matched sectors, and less likely if we observe scattered (singleton) matched sectors on the disk image. Experimental results show that my proposed approach produces more accurate application inference compared to existing methods. The key contribution of my work is improved completeness and accuracy for the current hash-based approach for catalog construction, and the improvement in the accuracy of application inference due to the new catalog and consideration of file system behavior.

Author

• Adegbehingbe, Oluwaseun

• digital forensics
• residual artifacts
• sector hashing
• software inference
• sub-file blocks
• uninstalled application

Identifier

hdl:1920/13923

OAI identifier oai:identifier

oai:MARS:1920/13923