Uncovering Limitations of E01 Self-Verifying Files

View Sample PDF

Author(s): Jan Krasniewicz (Birmingham City University, UK)and Sharon A. Cox (Birmingham City University, UK)
Copyright: 2019
Pages: 13
Source title: Advanced Methodologies and Technologies in System Security, Information Privacy, and Forensics
Source Author(s)/Editor(s): Mehdi Khosrow-Pour, D.B.A. (Information Resources Management Association, USA)
DOI: 10.4018/978-1-5225-7492-7.ch004

Keywords: Information Science Reference / Information Security & Privacy / IT Security and Ethics / Security & Forensics

Purchase

View Uncovering Limitations of E01 Self-Verifying Files on the publisher's website for pricing and purchasing information.

Abstract

In computer forensics, it is important to understand the purpose of evidence file formats to maintain continuity of acquired data from storage devices. Evidence file formats such as E01 contain embedded data such as cyclic redundancy check (CRC) and hash values to allow a program to verify the integrity of the data contained within it. Students in computer forensics courses need to understand the concepts of CRC and hash values as well as their use and limitations in evidence files when verifying acquired data. That is the CRC and hash values in evidence file only verify the acquired data and not the evidence file per se. This important difference in E01 files was highlighted by showing students an anomaly in E01 files where certain bytes can be changed in E01 files without detection by computer forensic software using the embedded CRC and hash values. The benefit to students is that they can see the advantages of self-verification and limitations of what is verified giving the opportunity for a deeper understanding of evidence files and good practice.

The IRMA Community

Research IRM

Uncovering Limitations of E01 Self-Verifying Files

Purchase

Abstract

Related Content

IRMA Sponsors