Logical Imaging File Structure for Digital Forensic Triage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional digital forensic tools lack compatibility in file formats, limiting the universal utilization of logical imaging methods for selective file seizure and imaging, which is essential for ensuring the reliability and integrity of digital evidence.
Innovation Solution
A logical imaging method for digital forensic triage that involves creating a logical imaging file with a predetermined file system structure, recording selected files within this structure, and generating hash values for integrity verification, along with separate files for selected list information and summary data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional forensic tools use their own proprietary formats for logical imaging, then they can maintain control over their imaging process and ensure integrity, but the formats are not compatible with other forensic tools, limiting universal utilization
Solution Approach 1:
The patent creates a logical imaging file that can be universally read by multiple forensic tools (EnCase, FTK, X-Ways, etc.) while maintaining the integrity and reliability required for digital evidence. The imaging file is designed with a standardized structure that differentiates evidence files from non-evidence files, allowing universal compatibility without sacrificing forensic reliability.
2Reliability
If physical imaging method is used to image the entirety of an existing disk, then complete evidence is captured, but personal information of unrelated individuals is also collected, raising privacy concerns
Solution Approach 1:
The patent extracts only the evidence-related files from the disk while leaving unrelated personal information behind. The logical imaging method selectively images only files that match evidence criteria, thereby capturing complete evidence without unnecessarily collecting personal information of unrelated individuals, thus resolving the privacy concern.
3Object-affected harmful factors
If selective file imaging is performed to protect personal information, then privacy is protected, but the reliability and integrity of the evidence image must be guaranteed through proper formatting and hashing
Solution Approach 1:
The patent performs preliminary actions by pre-defining the structure of the logical imaging file, including metadata areas and data areas, before actually imaging the evidence files. Hash values are calculated and recorded in advance, and the file system structure is prepared beforehand, which simplifies the overall process while ensuring reliability and integrity.
4Adaptability or versatility
If multiple separate files are created for logical imaging (imaging file, selected list file, summary file), then universal utilization and verification are enabled, but the overall system complexity increases
Solution Approach 1:
The patent segments the logical imaging output into three distinct but interconnected files: the logical imaging file (containing evidence data), the selected list information file (containing file listings and hash values), and the logical imaging summary file (containing verification information). This segmentation enables universal utilization and verification while organizing complexity into manageable, standardized components.
Data Source
AI summary
Disclosed herein are a logical imaging apparatus and method for digital forensic triage. The logical imaging method for digital forensic triage includes receiving files selected as a digital evidence target, creating a logical imaging file, inside of which is formatted in a predetermined file system structure, recording the selected files in accordance with the file system structure of the created logical imaging file, and storing selected file list information about a list of the recorded selected files, and creating a separate selected list information file and a separate logical imaging summary file outside the logical imaging file.