Approximate Search in Digital Forensics

Abstract

In digital forensics in general and in network forensics in particular, search through very large amounts of data plays a crucial role. It is used for finding evidence in digital media as well as for finding traces of attacks in computer memory and network traffic. The amount of data to be processed is not the only challenge faced by a search algorithm. Variations in data make the search task even more difficult, and the reasons for these variations are heterogeneous (transmission errors, differences in implementation of various protocols, different data formatting on various sources of information, attempts to hide the traces of criminal activities, and so on). In some cases, especially in network forensics, velocity of data is an additional factor that further complicates the task of a search algorithm. Therefore, the use of sophisticated search algorithms implemented in an efficient way and the reduction of data quantities to process are the key success factors of digital forensics investigation. In this chapter, constrained approximate bit-parallel search algorithms capable of both reducing the size of the data sets to process and efficiently processing the remaining data are explained. We analyze capabilities of these algorithms to correctly detect evidence/traces of attacks and to keep the false-positive rate at an acceptable level.