Authors: Michael Cohen (Google), Bradley Schatz, Ph.D. (Schatz Forensic)
DFRWS USA 2010
Abstract
Forensic imaging has been facing scalability challenges for some time. As disk capacity growth continues to outpace storage IO bandwidth, the demands placed on storage and time are ever increasing. Data reduction and de-duplication technologies are now commonplace in the Enterprise space and are potentially applicable to the forensic acquisition. Using the new AFF4 forensic file format we employ a hash-based compression scheme to leverage an existing corpus of images, reducing both acquisition time and storage requirements. This paper additionally describes some of the recent evolution in the AFF4 file format making the efficient implementation of hash-based imaging a reality.