2012 | OriginalPaper | Chapter
Domain-Specific Optimization in Digital Forensics
Authors : Jeroen van den Bos, Tijs van der Storm
Published in: Theory and Practice of Model Transformations
Publisher: Springer Berlin Heidelberg
Activate our intelligent search to find suitable subject content or patents.
Select sections of text to find matching patents with Artificial Intelligence. powered by
Select sections of text to find additional relevant content using AI-assisted search. powered by
File carvers are forensic software tools used to recover data from storage devices in order to find evidence. Every legal case requires different trade-offs between precision and runtime performance. The resulting required changes to the software tools are performed manually and under the strictest deadlines.
In this paper we present a model-driven approach to file carver development that enables these trade-offs to be automated. By transforming high-level file format specifications into approximations that are more permissive, forensic investigators can trade precision for performance, without having to change source.
Our study shows that performance gains up to a factor of three can be achieved, at the expense of up to 8% in precision and 5% in recall.