Improving Application Artifact Inference Using Matched Sector Adjacency Weighting

Abstract

Digital forensics investigators may need to infer the past presence of an application which was uninstalled prior to device seizure or media imaging. Some existing approaches use a catalog of fixed data block hashes to scan for evidence of a previously installed but now uninstalled application, but false positive sector-level matches may negatively impact algorithm performance. In an effort to get more accurate results when inferring prior application presence, we propose using a sector adjacency weighting method whereby we codify the intuition that an apparent application file remnant is more likely to be from the file of interest if we observe a run of contiguous matched sectors, and less likely if we observe scattered (singleton) matched sectors on the disk image. Test results show that the amount of false positive matching is reduced and the resulting inference is more accurate with the introduction of matched sector adjacency weighting.