Towards a Process Model for Hash Functions in Digital Forensics

Handling forensic investigations gets more and more difficult as the amount of data one has to analyze is increasing continuously. A common approach for automated file identification are hash functions. The proceeding is quite simple: a tool hashes all files of a seized device and compares them against a database. Depending on the database, this allows to discard non-relevant (whitelisting) or detect suspicious files (blacklisting).

[1]  Harald Baier,et al.  Similarity Preserving Hashing: Eligible Properties and a New Algorithm MRSH-v2 , 2012, ICDF2C.

[2]  Marcus K. Rogers,et al.  Computer Forensics Field Triage Process Model , 2006, J. Digit. Forensics Secur. Law.

[3]  Vishal Monga,et al.  Perceptual Image Hashing Via Feature Points: Performance Evaluation and Tradeoffs , 2006, IEEE Transactions on Image Processing.

[4]  Naphtali Rishe,et al.  Content-based image retrieval , 1995, Multimedia Tools and Applications.

[5]  Golden G. Richard,et al.  Multi-resolution similarity hashing , 2007, Digit. Investig..

[6]  Christoph Busch,et al.  mvHash-B - A New Approach for Similarity Preserving Hashing , 2013, 2013 Seventh International Conference on IT Security Incident Management and IT Forensics.

[7]  James H. Burrows,et al.  Secure Hash Standard , 1995 .

[8]  Z. Jane Wang,et al.  Perceptual Image Hashing Based on Shape Contexts and Local Feature Points , 2012, IEEE Transactions on Information Forensics and Security.

[9]  Michal Grega,et al.  INACT—INDECT Advanced Image Cataloguing Tool , 2011, Multimedia Tools and Applications.

[10]  Shijun Xiang,et al.  Histogram-Based Image Hashing for Searching Content-Preserving Copies , 2011, Trans. Data Hiding Multim. Secur..

[11]  Markus A. Stricker,et al.  Similarity of color images , 1995, Electronic Imaging.

[12]  Bart Preneel,et al.  From Image Hashing to Video Hashing , 2010, MMM.

[13]  Toshikazu Kato,et al.  Database architecture for content-based image retrieval , 1992, Electronic Imaging.

[14]  Martin Steinebach,et al.  ForBild: efficient robust image hashing , 2012, Other Conferences.

[15]  Michael J. Swain,et al.  Color indexing , 1991, International Journal of Computer Vision.

[16]  Harald Baier,et al.  Datenreduktion mittels kryptographischer Hashfunktionen in der IT-Forensik: Nur ein Mythos? , 2012 .

[17]  Edward J. Delp,et al.  Media Watermarking, Security, and Forensics III , 2011 .

[18]  Bian Yang,et al.  Block Mean Value Based Image Perceptual Hashing , 2006, 2006 International Conference on Intelligent Information Hiding and Multimedia.

[19]  Jean-Didier Legat,et al.  RASH: RAdon soft hash algorithm , 2002, 2002 11th European Signal Processing Conference.

[20]  Martin Steinebach.  Robust Hashing for Efficient Forensic Analysis of Image Sets , 2011, ICDF2C.

[21]  Mark Pollitt,et al.  An Ad Hoc Review of Digital Forensic Models , 2007, Second International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE'07).

[22]  Gonzalo R. Arce,et al.  A class of authentication digital watermarks for secure multimedia communication , 2001, IEEE Trans. Image Process..

[23]  Harald Baier,et al.  A Fuzzy Hashing Approach Based on Random Sequences and Hamming Distance , 2012 .

[24]  Vassil Roussev,et al.  Data Fingerprinting with Similarity Digests , 2010, IFIP Int. Conf. Digital Forensics.

[25]  Christoph Zauner,et al.  Implementation and Benchmarking of Perceptual Image Hash Functions , 2010 .

[26]  Christophe De Vleeschouwer,et al.  Robust image hashing based on radial variance of pixels , 2005, IEEE International Conference on Image Processing 2005.

[27]  David G. Lowe,et al.  Object recognition from local scale-invariant features , 1999, Proceedings of the Seventh IEEE International Conference on Computer Vision.

[28]  Sushil K. Bhattacharjee,et al.  Compression tolerant image authentication , 1998, Proceedings 1998 International Conference on Image Processing. ICIP98 (Cat. No.98CB36269).

[29]  Burton H. Bloom,et al.  Space/time trade-offs in hash coding with allowable errors , 1970, CACM.

[30]  Jean-Didier Legat,et al.  Practical evaluation of a radial soft hash algorithm , 2005, International Conference on Information Technology: Coding and Computing (ITCC'05) - Volume II.

[31]  Caitlin Sadowski.  SimHash : Hash-based Similarity Detection , 2007 .

[32]  Tiago Rosa Maria Paula Queluz.  Towards robust, content based techniques for image authentication , 1998, 1998 IEEE Second Workshop on Multimedia Signal Processing (Cat. No.98EX175).

[33]  Jiri Fridrich,et al.  Robust bit extraction from images , 1999, Proceedings IEEE International Conference on Multimedia Computing and Systems.

[34]  Eckehard Hermann,et al.  Rihamark: perceptual image hash benchmarking , 2011, Electronic Imaging.

[35]  Markus Schneider,et al.  F2S2: Fast forensic similarity search through indexing piecewise hash signatures , 2013, Digit. Investig..

[36]  Ramarathnam Venkatesan,et al.  Robust image hashing , 2000, Proceedings 2000 International Conference on Image Processing (Cat. No.00CH37101).

[37]  Harald Baier,et al.  FRASH: A framework to test algorithms of similarity hashing , 2013, Digit. Investig..

[38]  Andrei Z. Broder,et al.  On the resemblance and containment of documents , 1997, Proceedings. Compression and Complexity of SEQUENCES 1997 (Cat. No.97TB100171).

[39]  Vassil Roussev,et al.  An evaluation of forensic similarity hashes , 2011, Digit. Investig..