Bringing science to digital forensics with standardized forensic corpora
Elsevier (Digital Investigation) · 2009
Identifier: DOI 10.1016/j.diin.2009.06.016
Access and status
Cost
Partly free
Part of it is free and part is not. The entry says which part; read that before you plan around it.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Garfinkel, Farrell, Roussev and Dinolt's DFRWS 2009 paper, published in Digital Investigation, arguing that digital forensics could not be a science without shared, redistributable test data, and introducing the corpora — including the real-data disk images and the govdocs document set — that the field went on to use.
Who it is for, and when
Cite it when you need to establish why a tool or method claim is only meaningful against a known, shareable dataset, and when you need to explain to a court what forensic tool validation data looks like. Practically, it is the entry point to corpora you can still download and use to validate your own tooling or to test an opposing expert's claim. The DFRWS version is free on dfrws.org even though the Elsevier copy is paywalled.
What it does not cover
It does not validate any tool itself and does not tell you how to design a test plan; it makes the case for corpora and describes the ones the authors built. Some of the datasets it describes have since moved or been superseded, so check current hosting before relying on a link.
Go to the source
Open at doi.org (opens in a new tab)https://doi.org/10.1016/j.diin.2009.06.016
Details
- Type
- Paper or report
- Written for
- AdvancedAdvanced
- Publisher
- Elsevier (Digital Investigation)
- Year
- 2009
- Identifier
- DOI 10.1016/j.diin.2009.06.016
- Topics
- datasets, validation, tool-testing, research-publishing
- Checked at source
Related entries
A NIST repository of documented simulated digital evidence — images and data sets with known ground truth — developed with National Institute of Justice support. Holdings include scenario images (hacking case, data leakage case), Windows registry and Unicode string-search sets, Mac and mobile images, memory images, file carving and deleted-file-recovery sets, and reference/control drives.
The annual research challenges set alongside the DFRWS conferences, with scenario data, documentation and published results kept as repositories in the DFRWS GitHub organisation. Editions available there include 2005 (memory analysis), 2006, 2009 (PlayStation 3), 2012-2013, 2015, 2017 and 2018 (IoT), 2021 (multisource analysis and correlation) and 2023.
A corpus of 986,278 real files harvested from US government web servers, distributed as numbered archives on Digital Corpora. The published statistical report (contributed by Forensic Innovations, Inc.) breaks the collection down by type and originating platform — hundreds of thousands of documents, text files, images and hypertext files across Windows, UNIX, DOS and Macintosh origins.
A maintained index of populated mobile test images produced by Joshua Hickman and linked from his blog: Android 7 through 14, and iOS 13, 14 (with a macOS Big Sur image), 15, 16 and 17. Most are hosted by Digital Corpora, with one iOS 14 set on MediaFire.
The annual meeting of the American Academy of Forensic Sciences, a multidisciplinary body of over 6,500 members organised into twelve sections, one of which is Digital & Multimedia Sciences. The 79th Annual Scientific Conference is scheduled for 15-20 February 2027 at the Rosen Shingle Creek Hotel in Orlando, Florida.