Automating Disk Forensic Processing with SleuthKit, XML and Python

  • Authors:
  • Simson L. Garfinkel

  • Affiliations:
  • -

  • Venue:
  • SADFE '09 Proceedings of the 2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

We have developed a program called |fiwalk| which produces detailedXML describing all of the partitions and files on a hard drive or diskimage, as well as any extractable metadata from the document filesthemselves. We show how it is relatively simple to create automateddisk forensic applications using a Python module we have written thatreads |fiwalk|'s XML files. Finally, we present threeapplications using this system: a program to generate maps ofdisk images; an image redaction program; and a data transfer kioskwhich uses forensic tools to allow the migration of data from portablestorage devices without risk of infection from hostile software thatthe portable device may contain.