Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing
Ottmann J, Breitinger F, Freiling F (2022)
Publication Language: English
Publication Type: Conference contribution, Conference Contribution
Publication year: 2022
Conference Proceedings Title: Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU) 2022
Event location: Oxford
Abstract
The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a
forensic investigation. We revisit the discussion on quality criteria for “forensically sound” acquisition
of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from
a single target system. The idea of our definition is to allow a certain flexibility into when individual
portions of memory are acquired, but at the same time require being consistent with causality (i.e.,
cause/effect relations). Our concept is much stronger than the original notion of atomicity defined by
Vömel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we
also fix a conceptual problem within the original definition of integrity.
Authors with CRIS profile
Jenny Ottmann
Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)
Felix Freiling
Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)
Related research project(s)
Involved external institutions
Switzerland (CH)How to cite
APA:
Ottmann, J., Breitinger, F., & Freiling, F. (2022). Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing. In Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU) 2022. Oxford.
MLA:
Ottmann, Jenny, Frank Breitinger, and Felix Freiling. "Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing." Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU) 2022, Oxford 2022.
BibTeX: Download