Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing

Jenny Ottmann, Frank Breitinger, Felix Freiling

TL;DR

This paper tackles the problem of capturing memory snapshots for forensic analysis when system freezing is not possible, arguing that snapshots should respect causality while increasingly resembling an instantaneous view of memory. It introduces two new atomicity notions, instantaneous and quasi-instantaneous consistency, and shows how copy-on-write can achieve quasi-instantaneous snapshots while maintaining a link to causal consistency under certain assumptions. Alongside, it refines the integrity concept into restrictive and permissive forms to better capture measurement-induced changes, and presents a model-agnostic framework along with methods to measure and eventually evaluate these notions using vector clocks or real-time clocks. The work provides a practical path toward more trustworthy forensic storage snapshots, with implications for tool selection, evidential value, and future research directions in formalizing and validating snapshot quality in real-world investigations.

Abstract

The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a forensic investigation. We revisit the discussion on quality criteria for "forensically sound" acquisition of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from a single target system. The idea of our definition is to allow a certain flexibility into when individual portions of memory are acquired, but at the same time require being consistent with causality (i.e., cause/effect relations). Our concept is much stronger than the original notion of atomicity defined by Vomel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we also fix a conceptual problem within the original definition of integrity.

Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing

TL;DR

This paper tackles the problem of capturing memory snapshots for forensic analysis when system freezing is not possible, arguing that snapshots should respect causality while increasingly resembling an instantaneous view of memory. It introduces two new atomicity notions, instantaneous and quasi-instantaneous consistency, and shows how copy-on-write can achieve quasi-instantaneous snapshots while maintaining a link to causal consistency under certain assumptions. Alongside, it refines the integrity concept into restrictive and permissive forms to better capture measurement-induced changes, and presents a model-agnostic framework along with methods to measure and eventually evaluate these notions using vector clocks or real-time clocks. The work provides a practical path toward more trustworthy forensic storage snapshots, with implications for tool selection, evidential value, and future research directions in formalizing and validating snapshot quality in real-world investigations.

Abstract

The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a forensic investigation. We revisit the discussion on quality criteria for "forensically sound" acquisition of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from a single target system. The idea of our definition is to allow a certain flexibility into when individual portions of memory are acquired, but at the same time require being consistent with causality (i.e., cause/effect relations). Our concept is much stronger than the original notion of atomicity defined by Vomel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we also fix a conceptual problem within the original definition of integrity.

Paper Structure

This paper contains 29 sections, 2 theorems, 9 equations, 14 figures.

Table of Contents

  1. Introduction
  2. Inconsistencies in RAM acquisition
  3. The quest for suitable quality criteria
  4. Related work
  5. Contributions
  6. Outline
  7. Model
  8. Processes, memory regions and events
  9. Space/time diagrams and cuts
  10. Causal order on events
  11. Observability of causal relations
  12. Consistent global states
  13. Realtime
  14. Snapshots
  15. Defining Atomicity
  16. ...and 14 more sections

Key Result

Proposition 1

If all events are uniquely modifying, then any quasi-instantaneously consistent snapshot is also causally consistent.

Figures (14)

  • Figure 1: Space/time diagram of a computation and one possible cut C0. The events to the left of the cut are part of the past, those to the right part of the future.
  • Figure 2: Space/time diagram and possible cuts of a computation.
  • Figure 3: Lattice of global states of the computation depicted in Fig. \ref{['fig:lattice3']}.
  • Figure 4: Causally inconsistent snapshot.
  • Figure 5: When an instantaneous snapshot is taken, all memory regions are copied at the same time.
  • ...and 9 more figures

Theorems & Definitions (7)

  • Definition 1: instantaneous consistency
  • Definition 2: quasi-instantaneous consistency
  • Proposition 1
  • proof
  • Definition 3: permissive integrity
  • Proposition 2
  • proof