Testing Forensic Hash Tools on Sparse Files

: Forensic hash tools are usually used to prove and protect the integrity of digital evidence: When a file is intercepted by law enforcement, a cryprographic fingerprint is taken by using a forensic hash tool. If later in a court of law the identical fingerprint can be computed from the presented evidence, the evidence is taken to be original. In this paper we demonstrate that most of the freely available forensic hash tools fail to support this conclusion at the file system level for sparse files, a particular class of files in Unix systems that contain holes. We describe an experimental setup by which existing and future hash tools can be easily tested for this border case. In conclusion, we argue that further efforts are necessary to test and validate common forensic hash tools so that the significance of their results can be better judged.

• Type: Conference
• Year: 2007
• Where: IMF
• Authors: Harish Daiya, Maximillian Dornseif, Felix C. Freiling
• Keywords: Available Forensic Hash, Forensic Engineering, Forensic Hash Tools, Future Hash Tools, IMF 2007