Authors: Jan Gruber, Simson L. Garfinkel, Felix Freiling
DFRWS APAC 2026
Abstract
Verifying evidential integrity through hashing underpins the chain of custody in digital forensics, yet modernstorage technologies create complications because devices no longer reliably retain stale data. Sequential bitwise hashing is computationally expensive and sensitive to block-level changes caused by TRIM/Deallocate/Unmap operations on flash-based storage, where the controller silently alters blocks once they are deallocated; file hashing avoids this but is incomplete since it excludes relevant file system (FS) metadata. This article introduces tree-based active block hashing, a deterministic hashing scheme that leverages file system semantics to protect the integrity of active blocks. These data blocks are organized into a Merkle tree that remains invariant to TRIM-induced changes and, rather than merely signaling that verification failed, localizes modifications, including those affecting file system metadata, enabling examiners to pinpoint affected blocks, assess their evidential impact, and perform partial integrity verification. We formalize the construction, define activation functions for FAT, NTFS, and ext file systems, and present an open-source implementation. An empirical evaluation on solid-state drives with varying file systems and fill levels shows that active block hashing outperforms sequential bitwise hashing on partially filled media and remains competitive with FS parser-mediated file hashing while offering broader integrity coverage. Limitations arise for highly filled media and in the presence of file system corruption, indicating that the approach complements existing modification detection methods, as it characterizes a trade-off between integrity protection, computational efficiency, and granularity of integrity verification.