k-Dimensional hashing scheme for hard disk integrity verification in computer forensics

来源 :Journal of Zhejiang University-Science C(Computers & Electro | 被引量 : 0次 | 上传用户:mysqlfalse
下载到本地 , 更方便阅读
声明 : 本文档内容版权归属内容提供方 , 如果您对本文有版权争议 , 可与客服联系进行内容授权或下架
论文部分内容阅读
Verifying the integrity of a hard disk is an important concern in computer forensics,as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation.A typical approach is to compute a single chained hash value of all sectors in a specific order.However,this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified intentionally.In this paper we propose a k-dimensional hashing scheme,kD for short,to distribute sectors into a kD space,and to calculate multiple hash values for sectors in k dimensions as integrity evidence.Since the integrity of the sectors can be verified depending on any hash value calculated using the sectors,the probability to verify the integrity of unchanged sectors can be high even with bad/modified sectors in the hard disk.We show how to efficiently implement this kD hashing scheme such that the storage of hash values can be reduced while increasing the chance of an unaffected sector to be verified successfully.Experimental results of a 3D scheme show that both the time for computing the hash values and the storage for the hash values are reasonable. Verifying the integrity of a hard disk is an important concern in computer forensics, as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation. A typical approach is to compute a single chained hash value of all sectors in a specific order. Host, this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified intentionally. In this paper we propose a k-dimensional hashing scheme, kD for short , to distribute sectors into a kD space, and to calculate multiple hash values ​​for sectors in k dimensions as integrity evidence. Since the integrity of the sectors can be verified depending on any hash value calculated using the sectors, the probability to verify the integrity of unchanged sectors can be high even with bad / modified sectors in the hard disk. We show how may arable way kD hashing scheme such that the storage of hash values ​​can be red uced while increasing the chance of an unaffected sector to be verified successfully. Experimental results of a 3D scheme show that both the time for computing the hash values ​​and the storage for the hash values ​​are reasonable.
其他文献
读了今年第6期《老友》上《写本拙录嚼人生》一文,我和支部的几位老同志都深受启发。大家一致认为,这是一篇对读者很有指导作用的好文章。 After reading the sixth issue o
1前言有关情绪的神经基础的研究在神经科学里已有一段很长的历史。著名的奥尔兹(J.Olds)和米尔纳(P.Milnrr,1954)在动物按压杠杆的实验中用脑内电刺激法证明了边缘系统是产生情绪体验的中心。但是近几
《当代工人》现有文字编辑6人,美术编辑1人。这7人均为全日制本科以上学历,其中5人是研究生学历。从1990年代起,《当代工人》前总编辑赵洪顺在倡导刊物从指 There are 6 exi
《晚晴》 我的精神食粮  《晚晴》编辑部:  看了第四期《晚晴》,我很愉快,真可谓爱不释手。无论是内容还是形式,都让人耳目一新。  改版后的《晚晴》视野更开阔,一篇篇精炼的文章,道出了人间冷暖。在“非常道”栏目中,记者阎丘露薇说:“只有懂得爱护自己,才会懂得如何去爱别人,爱自己的亲人,爱自己的朋友,爱那些陌生人……经营好一个家庭,教育好子女,让他们拥有美好的品格。”我觉得这是每个人都应该拥有的品格
我们应用熊去氧胆酸联合水飞蓟宾治疗非酒精性脂肪型肝炎(non-alcoholic steaohepatitis,NASH)95例,并进行了临床观察,现将结果报告如下。1资料与方法1.1诊断标准:选择2008年
孩子关乎着未来,学生承载着老师的关注和汗水,关注学生、管理学生,我相信只要大家齐心协力,我们也一定会达到老子所提倡的"不拔""不脱"的境界的!
小溪流编辑部的叔叔阿姨:你们好!我是一个与你们素不相识的小女孩,我是今年才认识《小溪流》的,我觉得里面的内容非常丰富,很多错过了订书时间的同学都争先恐后地向我借着看,
本文通过对以往经典经济增长理论的总结,发现它们都是从长期角度给予一国经济增长的战略指引,缺乏检测短期经济波动的能力。因此本文用多元回归计量方法以货币流速建立了测度
目的分析扶风县肾综合症出血热(EHF)患者血清抗体与病程的关系。方法采用ELISA法检测临床诊断或疑似出血热患者血清抗体IgM。结果扶风县2005-2009年496份血清标本,流行性出血