Assessing the Impact of Matched Fragments' Relative Locations on Application Artifact Inference

One challenge in digital forensics is finding evidence of applications that have been uninstalled. When an application is uninstalled, the files making up the application are deleted. However, deleting a file doesn't necessarily immediately overwrite all the data (sectors) of the file. Investigators can find these orphaned file fragments (sectors) at some time after an application has been uninstalled and use them to infer the prior presence of whole files and hence associated applications. Prior work used a simple TF-IDF based weighting scheme to infer the prior presence of deleted application files and hence uninstalled applications. However, this method has limited accuracy because matching sectors not actually associated with a previously installed application result in application inference false positives. Most file systems write file sectors contiguously and files are cluster-aligned, suggesting a revised computation that might exploit these known and common behaviors to filter out many of these false matches. In this work, we add consideration of the relative locations of the matched sectors, where relative means (a) matching sector alignment relative to the original file of interest, and (b) matching sector alignment relative to cluster boundaries. We also add exponential weighting for file matches based on other work suggesting that the additional inferential value of each matching sector declines as more sectors are matched (i.e., two matches are not twice as useful as one match, etc.). Test results show that our proposed approach produces more accurate results than the prior work.