Authors: Kathryn Watkins, Mike McWhorter, Jeff Long, William Hill
DFRWS USA 2009
Abstract
This research seeks to minimize the transmission of unnecessary data when sending forensically sound drive images from remote client locations back to a central site. Files such as operating-system files, applications, and media files are likely to exist on many hard drives. The concept combines common data from local stores with unique data from the remote site to create new, forensically sound media images. Data that can be used from local stores need not be sent over the link. The result is substantially reduced amounts of data that must be transmitted between the two sites and stored at the central location. This paper describes Teleporter, a highly optimized file transfer method. The described research will also refine the understanding of the term forensically sound and introduce the term analytically sound.