Uncovering Limitations of E101 Self Verifying Files

Krasniewicz, Jan and Cox, Sharon (2017) Uncovering Limitations of E101 Self Verifying Files. In: Encyclopaedia of Information Science and Technology. IGI Global. ISBN 9781522522553

Full text not available from this repository. (Request a copy)


In computer forensics, it is important to understand the purpose of evidence file formats to maintain continuity of acquired data from storage devices. Evidence file formats such as E01 contain embedded data such as Cyclic Redundancy Check (CRC) and hash values to allow a program to verify the integrity of the data contained within it. Students on computer forensics courses need to understand the concepts of CRC and hash values as well as their use and limitations in evidence files when verifying acquired data. That is the CRC and hash values in evidence file only verify the acquired data and not the evidence file per se. This important difference in E01 files was highlighted by showing students an anomaly in E01 files where certain bytes can be changed in E01 files without detection by computer forensic software using the embedded CRC and hash values. The benefit to students is that they can see the advantages of self verification and limitations of what is verified giving the opportunity for a deeper understanding of evidence files and good practice.

Item Type: Book Section
Identification Number: https://doi.org/10.4018/978-1-5225-2255-3.ch119
30 June 2017Published
Subjects: CAH11 - computing > CAH11-01 - computing > CAH11-01-01 - computer science
Divisions: Faculty of Computing, Engineering and the Built Environment
Faculty of Computing, Engineering and the Built Environment > School of Computing and Digital Technology
Depositing User: Sharon Cox
Date Deposited: 12 Jun 2017 14:23
Last Modified: 22 Mar 2023 12:01
URI: https://www.open-access.bcu.ac.uk/id/eprint/4615

Actions (login required)

View Item View Item


In this section...