Data Corpora for Digital Forensics Education and Research

The availability of data corpora is important for research, development, and education in digital forensics. Several corpora exist and are available for academia, ranging from manually created small data sets of a few megabytes to many terabytes of real-world hard disk data. However, available corpora require a consideration of their usefulness for specific forensic tasks. Especially digital forensic tool testing relies on suitable corpora to determine relevant tool properties like effectiveness and efficiency. Real-data corpora are often desired for tool testing, however they typically lack a ground truth which provides valuable information. Generating synthetic data corpora can help improving tool testing and development, if the underlying methodology allows generating data with realistic properties. In this work we give an overview about available data corpora in the area of digital forensics and discuss which problems may arise when working with specific corpora. In an example we show that generating synthetic data corpora can be efficiently done where suitable real-world data may not be available. Using a self-developed framework we describe how to generate synthetic disk images in order to provide a corpus for testing disk analysis tools or for educating students in using these tools