File carvers are forensic software tools used to recover data from storage devices in order to find evidence. Every legal case requires different trade-offs between precision and runtime performance. The resulting required changes to the software tools are performed manually and under the strictest deadlines. In this paper we present a model-driven approach to file carver development that enables these trade-offs to be automated. By transforming high-level file format specifications into approximations that are more permissive forensic investigators can trade precision for performance without having to change source. Our study shows that performance gains up to a factor of 3 can be achieved at the expense of up to 8% in precision and 5% in recall.
Additional Metadata
Keywords Software, Design Tools and Techniques, computer-aided software engineering (CASE), Decision tables, Evolutionary prototyping, flow charts, Modules and interfaces, Object-oriented design methods, petri nets, Programmer workbench, Software libraries, State
THEME Software (theme 1)
Publisher Springer
Stakeholder Unspecified
Editor Z. Hu , J. de Lara
Series Lecture Notes in Computer Science
Conference International Conference on Model Transformation
Citation
van den Bos, J, & van der Storm, T. (2012). Domain-Specific Optimization in Digital Forensics. In Z Hu & J de Lara (Eds.), Proceedings of International Conference on Model Transformation 2012. Springer.