Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Model-based generation of synthetic disk images for digital forensic tool testing

: Yannikos, York; Winter, Christian


IEEE Computer Society:
International Conference on Availability, Reliability and Security, ARES 2013. Proceedings : 2-6 September 2013, Universität Regensburg, Germany, including workshops
Los Alamitos, Calif.: IEEE Computer Society Conference Publishing Services (CPS), 2013
ISBN: 978-0-7695-5008-4
ISBN: 978-1-4799-1097-7
International Conference on Availability, Reliability and Security (ARES) <8, 2013, Regensburg>
International Workshop on Digital Forensics (WSDF) <6, 2013, Regensburg>
Fraunhofer SIT ()
synthetic disk image generation; forensic tool testing; disk analysis tools; markov chains; model-based simulation

Testing digital forensic tools is important to determine relevant tool properties like effectiveness and efficiency. Since many different forensic tool categories exist, different testing techniques and especially suitable test data are required. Considering test data for disk analysis and data recovery tools, synthetic disk images provide significant advantages compared to disk images created from real-world storage devices. In this work we propose a framework for generating synthetic disk images for testing digital forensic analysis tools. The framework provides functionality for building models of real-world scenarios in which data on a storage device like a hard disk is created, changed, or deleted. Using such a model our framework allows simulating actions specified in the model in order to generate synthetic disk images with realistic characteristics. These disk images can then be used for testing the performance of forensic disk analysis and data recovery tools.