Defining atomicity (and integrity) for snapshots of storage in forensic computing

  • The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a forensic investigation. We revisit the discussion on quality criteria for "forensically sound" acquisition of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from a single target system. The idea of our definition is to allow a certain flexibility into when individual portions of memory are acquired, but at the same time require being consistent with causality (i.e., cause/effect relations). Our concept is much stronger than the original notion of atomicity defined by Vömel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we also fix a conceptual problem within the original definition of integrity.

Download full text files

Export metadata

Statistics

Number of document requests

Additional Services

Share in Twitter Search Google Scholar
Metadaten
Author:Jenny OttmannORCiD, Frank BreitingerORCiDGND, Felix FreilingORCiD
URN:urn:nbn:de:bvb:384-opus4-1177126
Frontdoor URLhttps://opus.bibliothek.uni-augsburg.de/opus4/117712
URL:https://dfrws.org/presentation/defining-atomicity-and-integrity-for-snapshots-of-storage-in-forensic-computing/
Parent Title (English):Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU) 2022, March 29 - April 1, 2022, Oxford, UK, hybrid
Publisher:DFRWS
Place of publication:Trumansburg, NY
Type:Conference Proceeding
Language:English
Date of Publication (online):2024/12/18
Year of first Publication:2022
Publishing Institution:Universität Augsburg
Release Date:2024/12/18
Edition:Online-Ressource
First Page:1
Last Page:11
Institutes:Fakultät für Angewandte Informatik
Fakultät für Angewandte Informatik / Institut für Informatik
Fakultät für Angewandte Informatik / Institut für Informatik / Lehrstuhl für Cybersicherheit
Dewey Decimal Classification:0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik
Licence (German):Deutsches Urheberrecht

OPUS4 Logo