File Download
  Links for fulltext
     (May Require Subscription)
Supplementary

Article: K-Dimensional hashing scheme for hard disk integrity verification in computer forensics

TitleK-Dimensional hashing scheme for hard disk integrity verification in computer forensics
Authors
KeywordsComputer Forensics
Digital Evidence
Hard Disk Integrity
K-Dimensional Hashing
Issue Date2011
PublisherZheijiang University Press and Springer-Verlag. The Journal's web site is located at http://www.springer.com/engineering/electronics/journal/11714
Citation
Journal Of Zhejiang University: Science C, 2011, v. 12 n. 10, p. 809-818 How to Cite?
AbstractVerifying the integrity of a hard disk is an important concern in computer forensics, as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation. A typical approach is to compute a single chained hash value of all sectors in a specific order. However, this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified intentionally. In this paper we propose a k-dimensional hashing scheme, kD for short, to distribute sectors into a kD space, and to calculate multiple hash values for sectors in k dimensions as integrity evidence. Since the integrity of the sectors can be verified depending on any hash value calculated using the sectors, the probability to verify the integrity of unchanged sectors can be high even with bad/modified sectors in the hard disk. We show how to efficiently implement this kD hashing scheme such that the storage of hash values can be reduced while increasing the chance of an unaffected sector to be verified successfully. Experimental results of a 3D scheme show that both the time for computing the hash values and the storage for the hash values are reasonable. © 2011 Journal of Zhejiang University Science Editorial Office and Springer-Verlag Berlin Heidelberg.
Persistent Identifierhttp://hdl.handle.net/10722/152476
ISSN
2015 Impact Factor: 0.392
ISI Accession Number ID
Funding AgencyGrant Number
Research Grants Council of Hong Kong SAR, ChinaRGC GRF HKU 713009E
NSFC/RGCN_HKU 722/09
HKU200811159155
200911159149
Funding Information:

Project supported by the Research Grants Council of Hong Kong SAR, China (No. RGC GRF HKU 713009E), the NSFC/RGC Joint Research Scheme (No. N_HKU 722/09), and HKU Seed Fundings for Basic Research (Nos. 200811159155 and 200911159149)

References
Grants

 

DC FieldValueLanguage
dc.contributor.authorJiang, ZLen_US
dc.contributor.authorFang, JBen_US
dc.contributor.authorHui, LCKen_US
dc.contributor.authorYiu, Sen_US
dc.contributor.authorChow, KPen_US
dc.contributor.authorSheng, MMen_US
dc.date.accessioned2012-06-26T06:39:30Z-
dc.date.available2012-06-26T06:39:30Z-
dc.date.issued2011en_US
dc.identifier.citationJournal Of Zhejiang University: Science C, 2011, v. 12 n. 10, p. 809-818en_US
dc.identifier.issn1869-1951en_US
dc.identifier.urihttp://hdl.handle.net/10722/152476-
dc.description.abstractVerifying the integrity of a hard disk is an important concern in computer forensics, as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation. A typical approach is to compute a single chained hash value of all sectors in a specific order. However, this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified intentionally. In this paper we propose a k-dimensional hashing scheme, kD for short, to distribute sectors into a kD space, and to calculate multiple hash values for sectors in k dimensions as integrity evidence. Since the integrity of the sectors can be verified depending on any hash value calculated using the sectors, the probability to verify the integrity of unchanged sectors can be high even with bad/modified sectors in the hard disk. We show how to efficiently implement this kD hashing scheme such that the storage of hash values can be reduced while increasing the chance of an unaffected sector to be verified successfully. Experimental results of a 3D scheme show that both the time for computing the hash values and the storage for the hash values are reasonable. © 2011 Journal of Zhejiang University Science Editorial Office and Springer-Verlag Berlin Heidelberg.en_US
dc.languageengen_US
dc.publisherZheijiang University Press and Springer-Verlag. The Journal's web site is located at http://www.springer.com/engineering/electronics/journal/11714-
dc.relation.ispartofJournal of Zhejiang University: Science Cen_US
dc.subjectComputer Forensicsen_US
dc.subjectDigital Evidenceen_US
dc.subjectHard Disk Integrityen_US
dc.subjectK-Dimensional Hashingen_US
dc.titleK-Dimensional hashing scheme for hard disk integrity verification in computer forensicsen_US
dc.typeArticleen_US
dc.identifier.emailHui, LCK:hui@cs.hku.hken_US
dc.identifier.emailYiu, S:smyiu@cs.hku.hken_US
dc.identifier.emailChow, KP:chow@cs.hku.hken_US
dc.identifier.authorityHui, LCK=rp00120en_US
dc.identifier.authorityYiu, S=rp00207en_US
dc.identifier.authorityChow, KP=rp00111en_US
dc.description.naturelink_to_subscribed_fulltexten_US
dc.identifier.doi10.1631/jzus.C1000425en_US
dc.identifier.scopuseid_2-s2.0-80755159526en_US
dc.identifier.hkuros223901-
dc.relation.referenceshttp://www.scopus.com/mlt/select.url?eid=2-s2.0-80755159526&selection=ref&src=s&origin=recordpageen_US
dc.identifier.volume12en_US
dc.identifier.issue10en_US
dc.identifier.spage809en_US
dc.identifier.epage818en_US
dc.identifier.isiWOS:000296253000003-
dc.relation.projectCryptanalysis and Implementation of Cipher-
dc.identifier.scopusauthoridJiang, ZL=24344329800en_US
dc.identifier.scopusauthoridFang, JB=36132767400en_US
dc.identifier.scopusauthoridHui, LCK=8905728300en_US
dc.identifier.scopusauthoridYiu, S=7003282240en_US
dc.identifier.scopusauthoridChow, KP=7202180751en_US
dc.identifier.scopusauthoridSheng, MM=54407420400en_US

Export via OAI-PMH Interface in XML Formats


OR


Export to Other Non-XML Formats