U.S. flag

An official website of the United States government, Department of Justice.

NCJRS Virtual Library

The Virtual Library houses over 235,000 criminal justice resources, including all known OJP works.
Click here to search the NCJRS Virtual Library

DEX: Digital evidence provenance supporting reproducibility and comparison

NCJ Number
305629
Journal
Digital Investigation Volume: 6 Issue: Supplement Dated: 2009 Pages: S48-S56
Author(s)
Brian Neil Levine ; Marc Liberatore
Date Published
2009
Length
9 pages
Annotation

Since the current standard and open formats for forensic data describe whole disk and memory image properties, but do not describe the products of detailed investigations, the authors propose a simple canonical description of digital evidence provenance that explicitly states the set of tools and transformations that led from acquired raw data to the resulting product.

Abstract

The format, called Digital Evidence Exchange (DEX), is independent of the forensic tool that discovered the evidence, which has several advantages. Using a DEX description and the raw image file, evidence can be reproduced by other tools with the same functionality. Additionally, DEX descriptions can identify differences between two separate investigations of the same raw evidence. Finally, as a standard product of tools, DEX can allow quick fabrication of tool chains either as best-of-breed amalgams or for tool testing. The authors have implemented DEX as an open-source library. (Publisher abstract provided)

Downloads