HAL : hal-00350962, version 1

arXiv : 0901.1307

Fiche détaillée

Récupérer au format BibTeX - EndNote - TEI - RefWorks -

42nd Hawaii International Conference on System Sciences, Waikoloa : United States (2009)

Using Graphics Processors for Parallelizing Hash-based Data Carving

Sylvain Collange 1, Yoginder Dandass 2, Marc Daumas 1, David Defour 1

(01/2009)

The ability to detect fragments of deleted image files and to reconstruct these image files from all available fragments on disk is a key activity in the field of digital forensics. Although reconstruction of image files from the file fragments on disk can be accomplished by simply comparing the content of sectors on disk with the content of known files, this brute-force approach can be time consuming. This paper presents results from research into the use of Graphics Processing Units (GPUs) in detecting specific image file byte patterns in disk clusters. Unique identifying pattern for each disk sector is compared against patterns in known images. A pattern match indicates the potential presence of an image and flags the disk sector for further in-depth examination to confirm the match. The GPU-based implementation outperforms the software implementation by a significant margin.

1 :	Electronique, Informatique, Automatique et Systèmes (ELIAUS)
	Université de Perpignan
2 :	Department of Computer Science and Engineering (CSE)
	Mississippi State University

Domaine

:

Informatique/Calcul parallèle, distribué et partagé

hal-00350962, version 1

http://hal.archives-ouvertes.fr/hal-00350962

oai:hal.archives-ouvertes.fr:hal-00350962

Contributeur : Marc Daumas <>

Soumis le : Mercredi 7 Janvier 2009, 23:32:39

Dernière modification le : Vendredi 9 Janvier 2009, 21:15:36