Forensic Feature Extraction for Digital Storage Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for processing and analyzing data from computer hard drives and other digital storage media are inefficient, leading to a backlog in processing and analysis of data collected during security operations, as they cannot handle the increased volume of data effectively.
Innovation Solution
The development of a system and software architecture, referred to as the Alix architecture, which enables the creation of disk images, extraction of forensic features, and cross-drive analysis to identify social networks and prioritize drives of interest, allowing for efficient management and analysis of large volumes of data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional methods are used to process and analyze hard drive data, then the analysis process remains simple and manageable, but the processing speed and volume of data that can be handled efficiently decreases
Solution Approach 1:
The system segments the forensic analysis process into distinct automated stages: imaging, feature extraction, indexing, and search. Each stage handles specific tasks independently, enabling parallel processing and increasing overall throughput while maintaining manageable complexity through modular design
Solution Approach 2:
The system introduces automated intermediary processes between data collection and analysis, including automated feature extraction engines and indexing mechanisms. These intermediaries process raw data into structured information, enabling faster query response and reducing the manual workload on analysts
2Quantity of substance
If more hard drives and storage media are collected during security operations, then the amount of available information increases, but the ability to process and analyze this information using conventional methods decreases
Solution Approach 1:
The system performs preliminary automated processing actions immediately upon data collection, including imaging, feature extraction, and indexing. This preliminary action prepares the data for rapid subsequent analysis and search, preventing the backlog problem by keeping the data pipeline continuously processed
Solution Approach 2:
The system creates digital copies (images) of physical hard drives and storage media, allowing multiple analysts to simultaneously access and analyze the same data without physically handling the original media. This copying enables parallel analysis workflows and increases overall analysis capacity
3Loss of time
If manual analysis of each drive is performed individually, then the depth of analysis for each drive remains high, but the time required to process all drives increases significantly
Solution Approach 1:
The system performs automated partial analysis (feature extraction) on all drives simultaneously to identify patterns and priorities, then directs human analysts to only the most promising drives for in-depth manual analysis. This partial automated action reduces overall processing time while preserving deep analysis capability where needed
Solution Approach 2:
The system implements feedback loops where automated feature extraction and cross-drive analysis continuously refine search criteria and prioritize drives based on emerging patterns. This feedback mechanism enables faster convergence on relevant leads, reducing the time required to process large drive collections while maintaining analysis quality
Data Source
AI summary
Computer-based systems and methods enable analysts to manage and explore the information that hard drives and other storage devices or sources of data may contain, and for extracting forensic features and performing cross drive analysis.