自动磁盘取证处理与SleuthKit, XML和Python

2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering Pub Date : 2009-05-21 DOI:10.1109/SADFE.2009.12

S. Garfinkel

{"title":"自动磁盘取证处理与SleuthKit, XML和Python","authors":"S. Garfinkel","doi":"10.1109/SADFE.2009.12","DOIUrl":null,"url":null,"abstract":"We have developed a program called |fiwalk| which produces detailedXML describing all of the partitions and files on a hard drive or diskimage, as well as any extractable metadata from the document filesthemselves. We show how it is relatively simple to create automateddisk forensic applications using a Python module we have written thatreads |fiwalk|'s XML files. Finally, we present threeapplications using this system: a program to generate maps ofdisk images; an image redaction program; and a data transfer kioskwhich uses forensic tools to allow the migration of data from portablestorage devices without risk of infection from hostile software thatthe portable device may contain.","PeriodicalId":101922,"journal":{"name":"2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"12 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2009-05-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"122","resultStr":"{\"title\":\"Automating Disk Forensic Processing with SleuthKit, XML and Python\",\"authors\":\"S. Garfinkel\",\"doi\":\"10.1109/SADFE.2009.12\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"We have developed a program called |fiwalk| which produces detailedXML describing all of the partitions and files on a hard drive or diskimage, as well as any extractable metadata from the document filesthemselves. We show how it is relatively simple to create automateddisk forensic applications using a Python module we have written thatreads |fiwalk|'s XML files. Finally, we present threeapplications using this system: a program to generate maps ofdisk images; an image redaction program; and a data transfer kioskwhich uses forensic tools to allow the migration of data from portablestorage devices without risk of infection from hostile software thatthe portable device may contain.\",\"PeriodicalId\":101922,\"journal\":{\"name\":\"2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering\",\"volume\":\"12 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2009-05-21\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"122\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1109/SADFE.2009.12\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/SADFE.2009.12","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 122

摘要

我们开发了一个名为fiwalk的程序，它生成详细的xml，描述硬盘驱动器或磁盘映像上的所有分区和文件，以及从文档文件本身提取的任何元数据。我们将展示如何使用我们编写的读取fiwalk XML文件的Python模块相对简单地创建自动磁盘取证应用程序。最后，我们介绍了使用该系统的三个应用程序:一个生成磁盘映像映射的程序;一个图像编辑程序;以及一种数据传输亭，该数据传输亭使用取证工具允许从便携式存储设备中迁移数据，而不会有被便携式设备可能包含的恶意软件感染的风险。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

查看原文本刊更多论文

Automating Disk Forensic Processing with SleuthKit, XML and Python

We have developed a program called |fiwalk| which produces detailedXML describing all of the partitions and files on a hard drive or diskimage, as well as any extractable metadata from the document filesthemselves. We show how it is relatively simple to create automateddisk forensic applications using a Python module we have written thatreads |fiwalk|'s XML files. Finally, we present threeapplications using this system: a program to generate maps ofdisk images; an image redaction program; and a data transfer kioskwhich uses forensic tools to allow the migration of data from portablestorage devices without risk of infection from hostile software thatthe portable device may contain.

求助全文

通过发布文献求助，成功后即可免费获取论文全文。去求助

来源期刊

2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering

自引率

0.00%

发文量