Low-Intrusive Consistent Disk Checkpointing: A Tool for Digital Forensics

Sriranjani Sitaraman (Department of Computer Science, University of Texas, USA)

S. Venkatesan (Department of Computer Science, University of Texas, USA)

Abstract: An important problem in digital forensics is to record a checkpoint of a disk drive mounted as a file system on a host machine without disrupting the disk s normal operations. We present a checkpointing methodology for a disk that has a Unix-like file system. While our algorithm is built around the Unix file system, it can be used to checkpoint disks formatted for other file systems such as NTFS, etc. Our algorithm satisfies several correctness conditions.

Keywords: Backup, Checkpointing, Consistency, Digital Forensics, File system, Operating System, Snapshot

Categories: D.4.3, D.4.6