Title: Assessment of uniformity of byte distribution in a file based on the wavelet transform as an approach to search encrypted data

Authors: Vesta Matveeva

Addresses: Department of Cryptology and Discrete Mathematics, National Research Nuclear University MEPhI (Moscow Engineering Physics Institute), Moscow, Russian Federation

Abstract: This article is focused on the search of the encrypted data in the file system, which is an important step in digital forensics. Encryption is widely used today, among others by malefactors to conceal data, suggesting that encrypted information can be hidden in the file system. There are means of detection of encrypted files, but they have significant limitations and may not be used for the free space of the file system. Statistical tests can also be used for this purpose but they are resource and time consuming. Therefore, the article proposes a new approach to searching for encrypted data, based on the assessment of uniformity of data, with the ability to localise the heterogeneity, which reduces type I error to zero. This approach has its drawbacks, in the form of type II errors; however it can be improved by manipulating parameters that are used for assessment of uniformity.

Keywords: digital forensics; file systems; concealed data; random data; statistical tests; encrypted data; distribution density; uniform sequences; uniformity assessment; heterogeneity localisation; wavelet transforms; chi-squared test; byte distribution; data encryption; cryptography; data security.

DOI: 10.1504/IJESDF.2015.069606

International Journal of Electronic Security and Digital Forensics, 2015 Vol.7 No.2, pp.134 - 146

Received: 14 Aug 2014
Accepted: 27 Jan 2015
Published online: 28 May 2015 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article