The use of similarity hashes combined with sampling techniques to improve disk forensics analysis

Digital forensics is a science related to the analysis of digital devices in order to find evidences of a crime. However, the overwhelming amount of data required to be handled, caused by the increase of storage capacity of hard disks, make examiners’ work harder and sometimes impossible to succeed in a reasonable time. For this reason, methods that can reduce the time needed in an investigation and yet be effective in finding evidences, are necessary. In this paper, we present a proposal that aims to reduce this time, by using statistical models where only partial data are evaluated with high probability of success, and to increase the accuracy in finding not only identical files but similar ones too, using a tool called sdhash. We emphasize that we work in the sector level, which can be effective in finding small pieces of files that were deleted but fragments of it still remain in disk.