Work

A metrics-based look at disk images: Insights and applications

Year: 2025

Type: article

Abstract: There is currently no systematic method for evaluating digital forensic datasets. This makes it difficult to judge their suitability for specific use cases in digital forensic education and training. Additionally, there is limited comparability in the quality of synthetic datasets or the strengths and weaknesses of different data synthesis approaches. In this paper, we propose the concept of a quantitative, metrics-based assessment of forensic datasets as a first step toward a systematic evaluation approach. As a concrete implementation of this approach, we introduce Mass Disk Processor , a tool that automates the collection of metrics from large sets of disk images. It enables a privacy-preserving retrieval of high-level disk image characteristics, facilitating the assessment of not only synthetic but also real-world disk images. We demonstrate two applications of our tool. First, we create a comprehensive datasheet for publicly available, scenario-based synthetic disk images. Second, we propose a formal definition of synthetic data realism that compares properties of synthetic data to properties of real-world data and present results from an examination of the realism of current scenario-based disk images.

Source: Forensic Science International Digital Investigation

DOI: 10.1016/j.fsidi.2025.301874

Authors: Lena L. Voigt, Felix Freiling, Christopher Hargreaves

Institutions: Friedrich-Alexander-Universität Erlangen-Nürnberg, University of Oxford

Language: English

Topic: Digital and Cyber Forensics

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Estimated APC paid: $3,100

Funder: Deutsche Forschungsgemeinschaft