Domain-Specific Optimization in Digital Forensics
Presented at the International Conference on Model Transformation, Prague, Czech Republic
File carvers are forensic software tools used to recover data from storage devices in order to find evidence. Every legal case requires different trade-offs between precision and runtime performance. The resulting required changes to the software tools are performed manually and under the strictest deadlines. In this paper we present a model-driven approach to file carver development that enables these trade-offs to be automated. By transforming high-level file format specifications into approximations that are more permissive forensic investigators can trade precision for performance without having to change source. Our study shows that performance gains up to a factor of 3 can be achieved at the expense of up to 8% in precision and 5% in recall.
|Keywords||Software, Design Tools and Techniques, computer-aided software engineering (CASE), Decision tables, Evolutionary prototyping, flow charts, Modules and interfaces, Object-oriented design methods, petri nets, Programmer workbench, Software libraries, State|
|THEME||Software (theme 1)|
|Editor||Z. Hu , J. de Lara|
|Series||Lecture Notes in Computer Science|
|Conference||International Conference on Model Transformation|
van den Bos, J, & van der Storm, T. (2012). Domain-Specific Optimization in Digital Forensics. In Z Hu & J de Lara (Eds.), Proceedings of International Conference on Model Transformation 2012. Springer.