SECURE, AUDITED PROCESSING OF DIGITAL EVIDENCE: FILESYSTEM SUPPORT FOR DIGITAL EVIDENCE BAGS

Abstract Traditional digital forensics methods capture, preserve, and analyze dig-ital evidence in standard electronic containers: images of seized hard drives (e.g., created using the Unix dd command) are stored in regu-lar files and documents are typically processed “as is”. Auditing of a digital investigation, from identification and seizure of evidence through duplication and investigation is essentially ad hoc, recorded in separate log files or in an investigator’s case notebook. Auditing performed in this fashion is bound to be incomplete, because different tools provide widely disparate amounts of auditing information. Over the course of an investigation, a piece of digital evidence may be touched by many different tools, some of which generate no audit trail of their actions (e.g., dd or the command line tools of the Sleuth Kit) and some that generate their own audit logs (e.g., FTK). At the end, an investigator is left to piece together these bits of audit trail to create a comprehensive view of what occurred during the investigation