{"title":"自动磁盘取证处理与SleuthKit, XML和Python","authors":"S. Garfinkel","doi":"10.1109/SADFE.2009.12","DOIUrl":null,"url":null,"abstract":"We have developed a program called |fiwalk| which produces detailedXML describing all of the partitions and files on a hard drive or diskimage, as well as any extractable metadata from the document filesthemselves. We show how it is relatively simple to create automateddisk forensic applications using a Python module we have written thatreads |fiwalk|'s XML files. Finally, we present threeapplications using this system: a program to generate maps ofdisk images; an image redaction program; and a data transfer kioskwhich uses forensic tools to allow the migration of data from portablestorage devices without risk of infection from hostile software thatthe portable device may contain.","PeriodicalId":101922,"journal":{"name":"2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"12 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2009-05-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"122","resultStr":"{\"title\":\"Automating Disk Forensic Processing with SleuthKit, XML and Python\",\"authors\":\"S. Garfinkel\",\"doi\":\"10.1109/SADFE.2009.12\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"We have developed a program called |fiwalk| which produces detailedXML describing all of the partitions and files on a hard drive or diskimage, as well as any extractable metadata from the document filesthemselves. We show how it is relatively simple to create automateddisk forensic applications using a Python module we have written thatreads |fiwalk|'s XML files. Finally, we present threeapplications using this system: a program to generate maps ofdisk images; an image redaction program; and a data transfer kioskwhich uses forensic tools to allow the migration of data from portablestorage devices without risk of infection from hostile software thatthe portable device may contain.\",\"PeriodicalId\":101922,\"journal\":{\"name\":\"2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering\",\"volume\":\"12 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2009-05-21\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"122\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1109/SADFE.2009.12\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/SADFE.2009.12","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
Automating Disk Forensic Processing with SleuthKit, XML and Python
We have developed a program called |fiwalk| which produces detailedXML describing all of the partitions and files on a hard drive or diskimage, as well as any extractable metadata from the document filesthemselves. We show how it is relatively simple to create automateddisk forensic applications using a Python module we have written thatreads |fiwalk|'s XML files. Finally, we present threeapplications using this system: a program to generate maps ofdisk images; an image redaction program; and a data transfer kioskwhich uses forensic tools to allow the migration of data from portablestorage devices without risk of infection from hostile software thatthe portable device may contain.
京公网安备 11010802042870号
京ICP备2023020795号-1
分享
求助内容：
应助结果提醒方式：
扫码关注我们
