Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees

back to overview

Reference

Lillis, D., Breitinger, F., & Scanlon, M. (2018). Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees. Paper presented at the International Conference on Digital Forensics and Cyber Crime (ICDF2C).

Publication type

Paper in Conference Proceedings

Abstract

Perhaps the most common task encountered by digital forensic investigators consists of searching through a seized device for pertinent data. Frequently, an investigator will be in possession of a collection of ``known-illegal'' files (e.g. a collection of child pornographic images) and will seek to find whether copies of these are stored on the seized drive. Traditional hash matching techniques can efficiently find files that precisely match. However, these will fail in the case of merged files, embedded files, partial files, or if a file has been changed in any way.

Persons

Organizational Units

  • Institute of Information Systems
  • Hilti Chair for Data and Application Security

DOI

http://dx.doi.org/10.1007/978-3-319-73697-6_11