Hardware-Assisted Scanning for Signature Patterns in Image File Fragments

Authors:
Yoginder S. Dandass
Affiliations:
Mississippi State University, USA
Venue:
HICSS '07 Proceedings of the 40th Annual Hawaii International Conference on System Sciences
Year:
2007

Citing 0
Cited 2

A Comparison of Forensic Hard Drive Imagers: A Time Analysis Comparison Between the ICS Image MASSter-Solo III and the Logicube Talon

Journal of Digital Forensic Practice
An Empirical Analysis of Disk Sector Hashes for Data Carving

Journal of Digital Forensic Practice

Quantified Score

Hi-index	0.00

Visualization

Abstract

The ability to detect fragments of deleted image files and to reconstruct these image files from all available fragments on disk is an important activity in the field of digital forensics. Although reconstruction of image files from the file fragments on disk can be accomplished by simply comparing the content of sectors on disk with the content of known files, this brute-force approach can be time consuming. This paper presents results from research into the use of field programmable gate arrays (FPGAs) in detecting specific image file byte patterns in disk clusters. Unique identifying pattern for each disk sector is compared against patterns in known images. A pattern match indicates the potential presence of an image and flags the disk sector for further in-depth examination to confirm the match. The FPGA-based implementation outperforms the software implementation by a significant margin.