Uncovering Limitations of E01 Self-Verifying Files

Abstract

In computer forensics, it is important to understand the purpose of evidence file formats to maintain continuity of acquired data from storage devices. Evidence file formats such as E01 contain embedded data such as Cyclic Redundancy Check (CRC) and hash values to allow a program to verify the integrity of the data contained within it. Students on computer forensics courses need to understand the concepts of CRC and hash values as well as their use and limitations in evidence files when verifying acquired data. That is the CRC and hash values in evidence file only verify the acquired data and not the evidence file per se. This important difference in E01 files was highlighted by showing students an anomaly in E01 files where certain bytes can be changed in E01 files without detection by computer forensic software using the embedded CRC and hash values. The benefit to students is that they can see the advantages of self verification and limitations of what is verified giving the opportunity for a deeper understanding of evidence files and good practice.