Domain-Specific Optimization in Digital Forensics
Presented at the International Conference on Model Transformation, Prague, Czech Republic
File carvers are forensic software tools used to recover data from storage devices in order to find evidence. Every legal case requires different trade-offs between precision and runtime performance. The resulting required changes to the software tools are performed manually and under the strictest deadlines. In this paper we present a model-driven approach to file carver development that enables these trade-offs to be automated. By transforming high-level file format specifications into approximations that are more permissive forensic investigators can trade precision for performance without having to change source. Our study shows that performance gains up to a factor of 3 can be achieved at the expense of up to 8% in precision and 5% in recall.
|, , , , , , , , , , ,|
|Z. Hu , J. de Lara|
|Lecture Notes in Computer Science|
|International Conference on Model Transformation|
|Organisation||Software Analysis and Transformation|
van den Bos, J, & van der Storm, T. (2012). Domain-Specific Optimization in Digital Forensics. In Z Hu & J de Lara (Eds.), Proceedings of International Conference on Model Transformation 2012. Springer.