Hard disk integrity check by hashing with combinatorial group testing

Abstract

In this paper, we describe the problem of verifying the integrity of a hard disk especially for forensics investigation after the computer of a suspect has been seized. Existing solutions do not provide a satisfactory solution to solve the problem. They either require a huge amount of storage to store the hash values of the sectors or may not be able to cope with the situation in an effective way in case some sectors have been modified (e.g. become bad sectors or deleted due to being part of the Legal Professional Privilege items). We introduce to use Thierry-Mieg[15]'s combinatorial group testing scheme, which seems to be an unrelated topic, to design a scheme to compute the hash values for the sectors of a hard disk. The storage for hash values in our scheme can be significantly fewer than the best existing solution while requiring similar amount of execution time. And our scheme can accurately point out the sectors which have been modified while existing solutions cannot guarantee this. © 2009 IEEE.