Model of hierarchical disk investigation

Abstract

Digital forensics investigators need specialized tools in order to retrieve evidence on hard disks. When using automated tools, only conventional areas of the disk are often analyzed and as a result potential evidence in hidden areas may be missed. One reason for this is the lack of a universal standard or approach with regards to the systematic disk investigation of the total disk area. In this paper, we present a new hierarchical disk investigation model that can be used to support automated digital forensics tools in systematically examining the disk in its totality, based on the disk's physical and logical structures. We have implemented our proposed model in an open source tool called Automated Disk Investigation Toolkit for illustration.