Show simple item record

dc.contributor.authorPierris, Georgios
dc.contributor.authorVidalis, Stilianos
dc.identifier.citationPierris , G & Vidalis , S 2012 , Forensically classifying files using HSOM algorithms . in Proceedings - 3rd International Conference on Emerging Intelligent Data and Web Technologies, EIDWT 2012 . , 6354746 , pp. 225-230 , 3rd International Conference on Emerging Intelligent Data and Web Technologies, EIDWT 2012 , Bucharest , 19/09/12 .
dc.identifier.otherPURE: 10606515
dc.identifier.otherPURE UUID: 7acb4266-2e30-4253-ade9-79e6b77ce356
dc.identifier.otherScopus: 84870734958
dc.descriptionGeorgios Pierris and Stilianos Vidalis, 'Forensically Classifying Files Using HSOM Algorithms', in Proceedings of the Third International Conference on Emerging Intelligent Data and Web Technologies (EIDWT), 19-21 September 2012, Bucharest, Romania. Published 20 November 2012 by IEEE. Available online at DOI: 10.1109/EIDWT.2012.46
dc.description.abstractIt has been accepted by Cloud Computing vendors that retrieving data from a cloud environment once they have been deleted is next to impossible. This constitutes a major hurdle for the digital forensics examiner as it greatly limits the pool of potential evidence that could be collected during an investigation. In this concept paper we will discuss a different approach to the above problem that spans across two different worlds: the world of digital forensics and the world of artificial intelligence. Block-based hash analysis works by calculating a hash value for each block of the target file that would be allocated a sector or cluster to store its data. The block hashes are then stored in a map file. The examiner then searches secondary memory areas to see if they contain blocks matching those contained in the map files. The examiner then has the ability to rebuild any file whose blocks have been located. The processes of hash-map calculation and analysis in the case of graphic images is accomplished using a single, dual-purpose EnScript in EnCase. Where a suspect file has been partially but not completely located the script will produce a PNG graphic showing exactly which blocks of the graphic have been located. This technique is extremely time and processor intensive, and does not work for unknown broken files. We hypothesize that we can use Hierarchical Self-Organizing Map algorithms in order to classify broken chains of previously unknown files, and in the future reconstruct them in order to be examined by the digital forensic examiner using the block-based hash analysis technique.en
dc.relation.ispartofProceedings - 3rd International Conference on Emerging Intelligent Data and Web Technologies, EIDWT 2012
dc.subjectblock-based hash map analysis
dc.subjectdigital forensic investigations
dc.subjectreconstructing broken files
dc.subjectArtificial Intelligence
dc.subjectComputer Networks and Communications
dc.subjectInformation Systems
dc.titleForensically classifying files using HSOM algorithmsen
dc.contributor.institutionSchool of Computer Science
dc.contributor.institutionCentre for Computer Science and Informatics Research
dc.relation.schoolSchool of Computer Science

Files in this item


There are no files associated with this item.

This item appears in the following Collection(s)

Show simple item record