Abstract:Most traditional digital forensic techniques identify irrelevant files in a corpus using keyword search, frequent hashes, frequent paths, and frequent size methods. These methods are based on Message Digest and Secure Hash Algorithm-1, which result in a hash collision. The threshold criteria of files based on frequent sizes will lead to imprecise threshold values that result in an increased evaluation of irrelevant files. The blacklisted keywords used in forensic search are based on literal and non-lexical, thus resulting in increased false-positive search results and failure to disambiguate unstructured text. Due to this, many extraneous files are also being considered for further investigations, exacerbating the time lag. Moreover, the non-availability of standardized forensic labeled data results in time complexity during the file classification process. This research proposes a three-tier Keyword Metadata Pattern framework to overcome these significant concerns. Initially, Secure Hash algorithm-256 hash for the entire corpus is constructed along with custom regex and stop-words module to overcome hash collision, imprecise threshold values, and eliminate recurrent files. Then blacklisted keywords are constructed by identifying vectorized words that have proximity to overcome traditional keyword search's drawbacks and to overcome false positive results. Dynamic forensic relevant patterns based on massive password datasets are designed to search for unique, relevant patterns to identify the significant files and overcome the time lag. Based on tier-2 results, files are preliminarily classified automatically in O(log n) complexity, and the system is trained with a machine learning model. Finally, when experimentally evaluated, the overall proposed system was found to be very effective, outperforming the existing two-tier model in terms of finding relevant files - y automated labeling and classification in O(nlog n) complexity. Our proposed model could eliminate 223K irrelevant files and reduce the corpus by 4.1% in tier-1, identify 16.06% of sensitive files in tier-2, and classify files with 91% precision, 95% sensitivity, 91% accuracy, and 0.11% Hamming loss compared to the two-tier system.

SIFT -- File Fragment Classification Without Metadata

A File Fragment Classification Method Based on Grayscale Image.

Hierarchy-Based File Fragment Classification

FiFTy: Large-scale File Fragment Type Identification using Neural Networks

File Fragment Type Classification Using Light-Weight Convolutional Neural Networks

File fragment recognition based on content and statistical features

A Comparative Study of SIFT and Its Variants

Efficient Image Copy Detection Using Multiscale Fingerprints

Document Type Classification using File Names

SecSIFT

File Fragment Classification using Light-Weight Convolutional Neural Networks

Fragments-Expert: A Graphical User Interface MATLAB Toolbox for Classification of File Fragments

A Sift-Based Image Fingerprinting Approach Robust to Geometric Transformations

SDOT: Secure Hash, Semantic Keyword Extraction, and Dynamic Operator Pattern-Based Three-Tier Forensic Classification Framework

File Fragment Classification Using Grayscale Image Conversion and Deep Learning in Digital Forensics

Fast SIFT algorithm based on Sobel edge detector

A Byte Sequence is Worth an Image: CNN for File Fragment Classification Using Bit Shift and n-Gram Embeddings

Medical Image Retrieval Using Sift Feature

A New Approach to Multimedia Files Carving

S-SIFT: A Shorter SIFT without Least Discriminability Visual Orientation

ByteNet: Rethinking Multimedia File Fragment Classification through Visual Perspectives