The Pre-images of Bitwise AND Functions in Forensic Analysis

Mechanisms now exist that detect tampering of a database, through the use of cryptographically-strong hash functions, as well as algorithms for forensic analysis of such tampering, thereby determining who, when, and what. This paper shows that for one such forensic analysis algorithm, the tiled bitmap algorithm, determining when and what, which goes far in determining who, has at its core computing the pre-image of bitwise AND functions. This paper introduces the notion of candidate set (the desired pre-image of a target binary number), provides a complete characterization of the candidate set, and characterizes the cardinality as well as the average cardinality. We then provide an optimal algorithm for computing the candidate set given a target. We show that given an auxiliary candidate array, the candidate set can be computed in constant time. This latter algorithm is applicable when the target is a suffix of another target number for which a candidate set has already been computed.