Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing

Details

Ressource 1Download: qualitycriteria.pdf (452.62 [Ko])
State: Public
Version: Final published version
License: Not specified
Serval ID
serval:BIB_F9E4FD8F2F1E
Type
Inproceedings: an article in a conference proceedings.
Collection
Publications
Institution
Title
Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing
Title of the conference
Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU)
Author(s)
Ottmann Jenny, Breitinger Frank, Freiling Felix
Publication state
Published
Issued date
31/03/2022
Peer-reviewed
Oui
Language
english
Abstract
The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a forensic investigation. We revisit the discussion on quality criteria for “forensically sound” acquisition of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from a single target system. The idea of our definition is to allow a certain flexibility into when individual portions of memory are acquired, but at the same time require being consistent with causality (i.e., cause/effect relations). Our concept is much stronger than the original notion of atomicity defined by Vömel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we also fix a conceptual problem within the original definition of integrity.
Keywords
storage acquisition, instantaneous snapshot, correctness, integrity
Create date
18/05/2022 9:33
Last modification date
20/07/2022 7:14
Usage data