article · 2012

Feature Extraction

Ziqian Wan, Alex J. Nelson, Tao Li, Darrell D. E. Long, Andy Hospodor, Ziqian Wan, Darrell D. E. Long, Alex J. Nelson, Tao Li, Andy Hospodor

Cited by 0Abstract and details only

Abstract

Geolocation data have high value to forensic investigators because computer activities may be associated with physical locations in the past. However, locating and extracting useful location information from an off-line disk image is a difficult problem. Most forensic investigations employ tools that focus on extracting content, such as emails, databases, and hidden or deleted data, and then manually investigate the results with practices like keyword searches. While this can work on a drive-by-drive basis, without a uniform approach to the location question, it is easy for an investigator to miss an answer that could be found from an evaluated technique known to other investigators. To determine drive location, we develop a two-step approach that analyzes a drive image for geolocation purposes, finding substantial location information in HTTP headers from common and default sources. First, we extract HTTP headers from the memory page (swap) files that reside on the hard drive. Second, we apply a weight based algorithm that parses those headers to determine the past geographical locations of the drive. We apply our method to drive images from the publicly available M57 Patents corpus and identify the hard drives ’ location with low recall but high precision. 1

Cite this paper

APA 7

Wan, Z., Nelson, A. J., Li, T., Long, D. D. E., Hospodor, A., Wan, Z., Long, D. D. E., Nelson, A. J., Li, T., & Hospodor, A. (2012). Feature Extraction.

MLA 9

Wan, Ziqian, et al. “Feature Extraction.” 2012.

Chicago

Wan, Ziqian, Alex J. Nelson, Tao Li, Darrell D. E. Long, Andy Hospodor, Ziqian Wan, Darrell D. E. Long, Alex J. Nelson, Tao Li, and Andy Hospodor. 2012. “Feature Extraction.”

Harvard

Wan, Z. et al. (2012) ‘Feature Extraction’.

BibTeX

@article{wan2012feature,
  title = {{Feature Extraction}},
  author = {Wan, Ziqian and Nelson, Alex J. and Li, Tao and Long, Darrell D. E. and Hospodor, Andy and Wan, Ziqian and Long, Darrell D. E. and Nelson, Alex J. and Li, Tao and Hospodor, Andy},
  year = {2012}
}

Made from the index record. Check names, capitalisation and page numbers against the paper. Need another style? AI for Research has over 10,000.