CoChat
Sign Up
Cited by 7Digital and Cyber ForensicsDigital Media Forensic DetectionAdvanced Steganography and Watermarking Techniques

The DOI matches its Crossref record.

Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems

Open access
McKeown, Sean, Russell, Gordon, Leimich, Petra·2019·The Journal of Digital Forensics, Security and Law
DOI 10.15394/jdfsl.2019.1591
Open this paper in CoChat — free accountOpen PDF

Abstract

A common investigative task is to identify known contraband images on a device, which typically involves calculating cryptographic hashes for all the files on a disk and checking these against a database of known contraband. However, modern drives are now so large that it can take several hours just to read this data from the disk, and can contribute to the large investigative backlogs suffered by many law enforcement bodies. Digital forensic triage techniques may thus be used to prioritise evidence and effect faster investigation turnarounds. This paper proposes a new forensic triage method for investigating disk evidence relating to picture files, making use of centralised thumbnail caches that are present in the Windows operating system. Such centralised caches serve as a catalogue of images on the device, allowing for fast triage. This work includes a comprehensive analysis of the thumbnail variants across a range of windows operating systems, which causes difficulties when detecting contraband using cryptographic hash databases. A novel method for large-scale hash database generation is described which allows precalculated cryptographic hash databases to be built from arbitrary image sets for use in thumbnail contraband detection. This approach allows for cryptographic hashes to be generated for multiple Windows versions from the original source image, facilitating wider detection. Finally, a more flexible approach is also proposed which makes novel use of perceptual hashing techniques, mitigating issues caused by the differences between thumbnails across Windows versions. A key contribution of this work demonstrates that by using new techniques, thumbnail caches can be used to robustly and effectively detect contraband in seconds, with processing times being largely independent of disk capacity.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.15394/jdfsl.2019.1591

Cites

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The robustness of perceptual hashing algorithms is not well understood for malicious and abusive content detection.

    “Despite the popularity and wide spread use of perceptual hashing, the robustness of these algorithms is not well understood for malicious and abusive content detection [21], as adversaries can produce image variants that may hinder detection and identification.”

    From Hamming distributions of popular perceptual hashing techniques (2023) · cites this paper as [21]

    Section 5.2 reports that the tested perceptual hashes missed some contraband-image thumbnails and identifies weaknesses that can cause false negatives. That supports a narrower concern about detection robustness, but the paper does not say that robustness is generally not well understood for malicious and abusive content detection or examine adversarially produced variants. Page numbers are unavailable in our copy. (LLM, conf=0.82)

    Experimental — accuracy not yet measured

  • Adversaries can produce image variants that may hinder detection and identification.

    “Despite the popularity and wide spread use of perceptual hashing, the robustness of these algorithms is not well understood for malicious and abusive content detection [21], as adversaries can produce image variants that may hinder detection and identification.”

    From Hamming distributions of popular perceptual hashing techniques (2023) · cites this paper as [21]

    Section 5.2 reports that perceptual-hash algorithms missed some thumbnails of known images, showing that image variants can hinder detection. The variants studied arose from Windows thumbnailing; the paper does not establish that adversaries produced them or tested deliberate evasion. Page numbers are unavailable in our copy. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

  • The distance distributions of inter- and intra-scores for each algorithm allow for a wider understanding of potential false positive and false negative rates for a given threshold distance.

    “The distance distributions of interand intra-scores for each algorithm then allow for a wider understanding of potential false positive and false negative rates for a given threshold distance, as discussed in prior work [21, 27].”

    From Hamming distributions of popular perceptual hashing techniques (2023) · cites this paper as [21]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

No references could be resolved yet.

Research works printed but not linked: 21

  1. Beebe, N. (2009). Digital forensic research: The good, the bad and the unaddressed. In IFIP International Conference on Digital Forensics (pp. 17-36). Springer.
  2. Breitinger, F., Liu, H., Winter, C., Baier, H., Ry- balchenko, A., & Steinebach, M. (2013). Towards a process model for hash func- tions in digital forensics. In International Conference on Digital Forensics and Cyber Crime (pp. 170-186). Springer.
  3. Dandass, Y. S., Necaise, N. J., & Thomas, S. R. (2008, April). An Empirical Analysis of Disk Sector Hashes for Data Carving. J. Digit. Forensic Pract., 2 (2), 95-104. doi: 10.1080/15567280802050436 · DOI
  4. Franqueira, V. N., Bryce, J., Al Mutawa, N., & Marrington, A. (2018, December). In- vestigation of Indecent Images of Children cases: Challenges and suggestions collected from the trenches. Digital Investigation. doi: 10.1016/j.diin.2017.11.002 · DOI
  5. Garfinkel, S. L. (2010, August). Digital foren- sics research: The next 10 years. Digital Investigation, 7 , S64-S73. (DFRWS USA 2010. The Proceedings of the Tenth Digi- tal Forensics Research Workshop. Philadel- phia. Aug 2-4, 2010.). doi: 10.1016/j.diin .2010.05.009 · DOI
  6. Garfinkel, S. L. (2013, February). Digital media triage with bulk data analysis and bulk extractor. Computers & Security, 32 , 56-72. doi: 10.1016/j.cose.2012.09.011 · DOI
  7. Grier, J., & Richard, G. G. (2015, August). Rapid forensic imaging of large disks with sifting collectors. Digital Investigation, 14 , S34-S44. doi: 10.1016/j.diin.2015.05.006 · DOI
  8. Huiskes, M. J., Thomee, B., & Lew, M. S. (2010). New trends and ideas in visual concept de- tection: the MIR flickr retrieval evaluation initiative. In Proceedings of the interna- tional conference on Multimedia informa- tion retrieval (pp. 527-536). ACM.
  9. James, J. I., & Gladyshev, P. (2013, Septem- ber). A survey of digital forensic investi- gator decision processes and measurement of decisions based on enhanced preview. Digital Investigation, 10 (2), 148-157. doi: 10.1016/j.diin.2013.04.005 · DOI
  10. Leom, M. D., DOrazio, C. J., Deegan, G., & Choo, K.-K. R. (2015, August). Foren- sic Collection and Analysis of Thumbnails in Android. In (pp. 1059-1066). IEEE. doi: 10.1109/Trustcom.2015.483 · DOI
  11. Lillis, D., Becker, B., O'Sullivan, T., & Scanlon, M. (2016, April). Current Challenges and Future Research Areas for Digital Foren- sic Investigation. arXiv:1604.03850 [cs] . (arXiv: 1604.03850) · arXiv
  12. Morris, S., & Chivers, H. (2010). A com- parative study of the structure and be- haviour of the operating system thumbnail caches used in Kubuntu and Ubuntu (9.10 and 10.04). Proc. of the 4th Cybercrime Forensics Education & Training. Canter- bury Christ Church University, Canter- bury, UK .
  13. Morris, S., & Chivers, H. (2011a). An analy- sis of the structure and behaviour of the Windows 7 operating system thumbnail cache. In Proceedings from 1st Cyberforen- sics Conference.
  14. Norouzi, M., Punjani, A., & Fleet, D. J. (2012). Fast search in hamming space with multi- index hashing. In Computer Vision and Pattern Recognition (CVPR), 2012 IEEE Conference on (pp. 3108-3115). IEEE.
  15. Penrose, P., Buchanan, W. J., & Macfarlane, R. (2015, March). Fast contraband de- tection in large capacity disk drives. Dig- ital Investigation, 12, Supplement 1 , S22- S29. (DFRWS EU 2015. The Proceedings of the Tenth Digital Forensics Research Workshop. Dublin. March 23-26, 2015.). doi: 10.1016/j.diin.2015.01.007 · DOI
  16. Quick, D., & Choo, K.-K. R. (2014, December). Impacts of increasing volume of digital forensic data: A survey and future research challenges. Digital Investigation, 11 (4), 273-294. doi: 10.1016/j.diin.2014.09.002 · DOI
  17. Quick, D., Tassone, C., & Choo, K.-K. R. (2014). Forensic Analysis of Windows Thumbcache files. Quick D, Tassone C and Choo KK R. Roussev, V., & Quates, C. (2012, August). Con- tent triage with similarity digests: The M57 case study. Digital Investigation, 9 , S60-S68. (DFRWS USA 2012. The Pro- ceedings of the Tenth Digital Forensics Re- search Workshop. Washington DC. August 6-8, 2012.). doi: 10.1016/j.diin.2012.05 .012 · DOI
  18. Roussev, V., Quates, C., & Martell, R. (2013, September). Real-time digital forensics and triage. Digital Investigation, 10 (2), 158-167. doi: 10.1016/j.diin.2013.02.001 · DOI
  19. Shaw, A., & Browne, A. (2013, September). A practical and robust approach to cop- ing with large volumes of data submitted for digital forensic examination. Digital In- vestigation, 10 (2), 116-128. doi: 10.1016/ j.diin.2013.04.003 · DOI
  20. Yang, B., Gu, F., & Niu, X. (2006). Block mean value based image perceptual hash- ing. In Intelligent Information Hiding and Multimedia Signal Processing, 2006. IIH- MSP'06. International Conference on (pp. 167-172). IEEE.
  21. Young, J., Foster, K., Garfinkel, S., & Fairbanks, K. (2012). Distinct sector hashes for target file detection. Computer , 45 (12), 28-35.

Cited by

Sorted by citations

Metadata

Authors
McKeown, S., Russell, G., & Leimich, P.
Affiliations
Edinburgh Napier University (GB)
Corresponding author
Leimich, Petra
ORCID
Venue
The Journal of Digital Forensics, Security and Law
Publisher
ERAU Hunt Library - DIGITAL COMMONS JOURNALS
Published
2019
ISSN
  • 1558-7215 (ISSN-L)
  • 1558-7223
DOI
10.15394/jdfsl.2019.1591
OpenAlex
W3008985704
Cited by
7
References
0
Citations by year
2025: 3 · 2024: 2 · 2023: 2
FWCI
0.00
Type
journal article
Language
en
Open access
Licence
cc-by-nc
Locations
  • The journal of digital forensics, security and law (publishedVersion, cc-by-nc)
  • Scholarly Commons (Embry–Riddle Aeronautical University) (submittedVersion, cc-by-nc)
  • Edinburgh Napier Research Repository (Edinburgh Napier University) (submittedVersion, cc-by-nc)
Topics
  • Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Steganography and Watermarking Techniques
Keywords
forensic triage, Microsoft Windows, perceptual hashing, image forensics

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review