Forensic disk image indexing and search in an HPC environment

Abstract

We describe a solution for fast indexing and searching within large heterogeneous data sets whose main purpose is to support investigators that need to analyze forensic disk images originated by seizures or created from bodies of evidence. Our approach is based on a combination of techniques aimed at improving efficiency and reliability of the indexing process.We do not rely on existing frameworks like Hadoop but borrow concepts from different contexts including High Performance Computing and Database management.