Wiley Handbook of Science and Technology for Homeland Security, 4 Volume Set

FILE FORENSICS AND CONVERSION

BRIAN D. CARRIER

Basis Technology, Cambridge, Massachusetts

1 INTRODUCTION

File forensics is the analysis of digital files to answer some form of question. For example, the question could be “which files contain the keyword X.” This type of question is frequently asked in law enforcement and intelligence gathering contexts and the answer can identify if someone is guilty or innocent or identify people or places that are a threat or that are threatened. Files contain user-created content and are therefore crucial to learning about the actions of the computer's user. This article focuses on the state of the art and the challenges associated with file forensics. The other areas of digital forensics are outlined in other articles of this book. The first section outlines the general process of file forensics and the second section outlines the technology areas used. The third section describes the unique need areas that exist and the fourth section provides requirements for future file forensics efforts.

2 PROCESS OVERVIEW

2.1 Digital Investigation Process

File forensics fits into the larger area of digital investigations, which is also called digital forensics or media exploitation [1]. Digital investigations analyze digital data to answer questions about the current or previous state of the data or about previous digital events. The full process is similar to a physical crime scene investigation [2]. At a physical crime scene, the state is preserved by ...