27004101
A Network-Based Architecture for Storing Digital Evidence
The storage and handling of digital evidence are creating significant challenges for federal, state and local law enforcement agencies. The problems include acquiring and processing massive amounts of digital evidence, maintaining the integrity of the evidence, and storing digital evidence for extended periods of time. This paper describes a network-based storage architecture that helps address these issues. The architecture also supports collaborative efforts by examiners and investigators located at geographically dispersed sites.
41330468
Detecting Data Concealment Programs Using File System Analysis
An improved closure and nozzle system for containers for air-curable materials such as cartridges for sealant and caulking compounds is disclosed. A container such as a caulking cartridge is provided with a threaded neck for attachment of a correspondingly threaded nozzle having a tapered tip portion designed to be cut off to provide a desired orifice size. A cap having a snap-fit ring is designed to mate with a corresponding snap-fit ring on the nozzle short of the tip and also having a threaded external portion designed to mate with the container neck so that the cartridge can be resealed after opening.
6966708
Countering Hostile Forensic Techniques
Digital forensic investigations can be subverted by hostile forensic techniques and tools. This paper examines various hostile forensic techniques, including the exploitation of vulnerabilities in standard forensic procedures and denial of service attacks on forensic tools during imaging and analysis. Several techniques for concealing evidence within file systems and external to file systems are highlighted. In addition, strategies for countering hostile forensic techniques and tools are discussed.
31126198
Detecting Hidden Data in Ext2/Ext3 File Systems
The use of digital forensic tools by law enforcement agencies has made it difficult for malicious individuals to hide potentially incriminating evidence. To combat this situation, the hacker community has developed anti-forensic tools that remove or hide electronic evidence for the specific purpose of undermining forensic investigations. This paper examines the latest techniques for hiding data in the popular Ext2 and Ext3 file systems. It also describes techniques for detecting hidden data in the reserved portions of these file systems.
16068675
Experimental investigation on VoIP performance and the resource utilization in 802.11b WLANs
In a shared medium network like the 802.11b WLAN, predicting the quality of VoIP calls from the resource usage of the wireless medium is highly desirable. Analyzing the bandwidth usage at the L2/MAC layer may be especially useful for potential QoS provisioning and call admission schemes. This paper experimentally investigates the relationship between resource utilization in WLANs and the quality of VoIP calls transmitted over wireless medium. Specifically we evaluate how the amount of free bandwidth influences transmission impairments (i.e. delay, loss, and jitter) and thus call quality. Resource utilization (under the MAC bandwidth components framework) is calculated by a WLAN resource monitoring application that passively "sniffs" packets at the L2/MAC layer and analyses their headers and temporal characteristics. The quality of VoIP calls is predicted using an extended version of the ITU-T E-model, which estimates user satisfaction from time varying transmission impairments
10200775
A wireless traffic probe for radio resource management and QoS provisioning in IEEE 802.11 WLANs
The emergence of real-time services such as voice over IP (VoIP) and video streaming, imposes stringent requirements on the performance of a network if quality of service (QoS) targets are to be achieved. In the case of wireless networks, some form of radio resource management (RRM) is typically required to allocate the available resources among the contending stations in accordance with their needs and respective priorities. A critical aspect of any RRM scheme is the ability to monitor resource usage and to determine the resource requirements on a per-station basis. In this paper we describe a wireless traffic probe for IEEE 802.11 WLANs capable of obtaining this information and presenting it in a compact and intuitive format. The probe also shows how the wireless stations interact with one another in competing for the resources of the WLAN in a clear and quantifiable way. The results from the WLAN traffic probe obtained in a series of video streaming test scenarios are also presented that clearly demonstrate its usefulness and importance as a network tool in RRM and QoS provisioning schemes.
5625582
Experimental evaluation of the Hewlett-Parkard exemplar file system
This article presents results from an experimental evaluation study of the HP Exemplar file system. Our experiments consist of simple micro-benchmarks that study the impact of various factors on the file system performance. These factors include I/O request/buffer sizes, vectored/non-vectored access patterns, read-ahead policies, multi-threaded (temporally irregular) requests, and architectural issues (cache parameters, NUMA behavior, etc.). Experimental results indicate that the Exemplar file system provides high I/O bandwidth, both for single- and multi-threaded applications. The buffer cache, with prioritized buffer management and large buffer sizes, is effective in exploiting temporal and spatial access localities. The performance of non-contiguous accesses can be improved by either using vectored I/O interfaces or tuning the read-ahead facilities. The file system performance depends on the relative locations of the computing threads and the file system, and also on various Exemplar design parameters such as the NUMA architecture, TLB/data cache management and paging policies.
553221
An Experimental Investigation of Parallel Multimedia Streams Over IEEE 802.11e WLAN Networks Using TXOP
In this paper we perform an experimental investigation of the IEEE 802.11e TXOP facility to enhance the transmission of parallel multimedia streaming sessions through efficient bandwidth reservation and explicitly consider both the audio and video streams. The delay constraints associated with the audio and video streams that comprise a multimedia session pose the greatest challenge since real-time multimedia is particularly sensitive to delay as the packets require a strict bounded end-to-end delay. We show how the TXOPLimit parameter can be efficiently dimensioned to reduce the transmission delay for the video frames. Due to its frame-based nature, video applications are considered to be bursty as each video frame is typically transmitted as a burst of packets. The size of the burst is related to the size of the video frame and the number of packets required to transmit the video frame. The TXOP facility is particularly suited to efficiently deal with this burstiness since it can be used to reserve bandwidth for the duration of the packet burst. Through experimental investigation, we show that there is a significant performance improvement for the video streams by using the TXOPLimit parameter however there is no such improvement for the audio streams. We show that over-dimensioning the TXOPLimit parameter can cause the video stream to seize too much bandwidth which results in a deterioration in performance for the other competing traffic streams. This deterioration becomes more prominent as the number of parallel multimedia streams increases. We show that there is a performance improvement to all traffic streams by providing differentiated service to the constituent I, P, and B video frame types in conjunction with the TXOP facility.
2180308
RARE - Resource Aware Routing for mEsh
An important element of any routing protocol used for wireless mesh networks (WMNs) is the link cost function used to represent the radio link characteristic. The majority of the routing protocols for WMNs attempt to accurately characterise the radio link quality by constructing the link cost function from the measurements obtained using active probing techniques, which introduces overhead. In this paper we propose a new approach called resource aware routing for mesh (RARE) which instead employs passive monitoring to gather radio link information. This results in a smaller overhead than the other methods that require active network probing, and is load independent since it does not require an access to the medium. Moreover, we show that our RARE approach performs well in a real radio environment through a number of experiments performed on a static 17 node WLAN mesh testbed.