A statistical method for detecting on-disk wiped areas

作者：Savoldi Antonio^*; Piccinelli Mario; Gubian Paolo

来源：Digital Investigation, 2012, 8(3-4): 194-214.

DOI：10.1016/j.diin.2011.06.005

• Wiping detection
• Anti-forensics
• Data wiping
• Anti-anti-forensics
• Linear classifier

Data-wiping tools are meant to securely erase data. Malicious users may resort to such tools to eliminate traces of a crime they have committed. State-of-the-art wiping detection techniques rely on artifacts left by the use of such tools. However, in certain cases such artifacts can be obfuscated and the investigator is left with almost no clues that could point to a digital crime. Indeed, in this paper we would like to present a scenario involving an ideal data-wiping case (i.e. a method that does not leave any usual exploitable artifacts). In addition, we demonstrate an efficient statistical technique which allows the detection of on-disk wiped areas, both filled with random and periodic data. The performance and usability of the proposed techniques are discussed as well.

• 出版日期2012-2