Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing

TL;DR

This paper proposes a new, causality-consistent definition of atomicity for forensic storage snapshots, improving data acquisition quality criteria and fixing conceptual issues in existing integrity definitions.

Contribution

It introduces a flexible yet causality-aware atomicity concept for forensic snapshots, enhancing the reliability of data acquisition in forensic investigations.

Findings

Defines a causality-consistent atomicity for storage snapshots

Uses copy-on-write mechanisms to achieve the new atomicity

Fixes a conceptual problem in the original integrity definition

Abstract

The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a forensic investigation. We revisit the discussion on quality criteria for "forensically sound" acquisition of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from a single target system. The idea of our definition is to allow a certain flexibility into when individual portions of memory are acquired, but at the same time require being consistent with causality (i.e., cause/effect relations). Our concept is much stronger than the original notion of atomicity defined by Vomel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we also fix a conceptual problem within the original definition of integrity.