Data Compression Algorithms.Use of Compression Algorithms in Forensics - Essay Example

?Data Compression Algorithms From the many years, numerous data compression algorithms have been developed to deal with specific data compression problem. From the developed data compression algorithms, there does not exist a single compression algorithm that compress all data types efficiently. Therefore, each algorithm has a number of strengths as well as weaknesses. The compression algorithms are also commonly used in forensics. These algorithms are used to reduce space amount required to store data on the computer hard disk. Usually, these algorithms are employed on the large files so that their size may be reduced. Mainly, there are two types of the compression algorithms include: lossless and lossy algorithms. The lossless compression algorithms have been developed to compress the data with hundred percent (100%) original data reconstruction from the compressed data. In these algorithms, you do not lose any data, as it preserves all the data as it is in novel form. For compressing the text or images, the algorithms that are used include: LZW, Borrows-Wheeler transform and LZ77 and Prediction by Partial Matching (also known as PPM). General purpose lossless compression algorithm include: run-length encoding, Lempel-Ziv 1978 (LZ78) and Lempel-Ziv-Welch (LZW). On the other hand, the lossy compression algorithms are mostly used to compress audio and video data or files. These algorithms are used to endeavour reducing or even eliminating the superfluous or redundant information from the video or audio files. Typically, the lossy algorithms or techniques attain a advanced level of compression by plummeting the by and large quality of the sound or image. In order to compress an image, the lossy algorithms that are used include: Wavelet Compression, block truncation coding, fractal compression, etc. Whereas, for video files, the algorithms include: DV, MPEG (I to IV), etc. and for the audio file famous techniques are MP3, MP2, AAC etc. Use of Compression Algorithms in Forensics The data compression algorithms are commonly used in forensics tools to get help during electronic investigations. There are a number of implications for the forensic inspector during an analysis or investigation these include: only the lossless compression can be utilized in forensics analysis, however, lossy compression cannot be used because it alters the original data but through the hash collisions , a compressed folder or file could be in a combination of both compressed and uncompressed data, it is recommended that the text file or data can always be compressed or decompressed by the lossless algorithms as a word document may contains a number of documents, therefore it is critical to lose any document. It should be kept in mind that if a Word document presents on hard disk in a compressed structure, when deleted then it resides in its compressed form. Therefore, searching a hard disk intended for a keyword will not get any result if the keyword only contained by the compressed deleted file. Whereas, on the other hand, an image file such as the JPEG has already been compressed in high format, therefore, it will yield deprived compression. In fact jpg’s usually have a compressed first cluster (this normally contains manufacturers info) followed by uncompressed clusters and compression units. It should be known to the forensic examiner that decompressing a file without remedy to the files Master File Table (MFT) record might not be achievable i.e. the only sign of whether a compression run has been compressed is within the MFT. It means that if a record of a file named ‘document’ is not available in the MFT, the operations of decompressing the file or extracting the compressed file may not be successful. PST Viewer According to the Forensic Control Limited in June 2012, the top (10) free computer forensic software are OSForensics, FTK Imager, Forensic Image Viewer, FoxAnalysis, Mail Viewer, PST Viewer, USB Write Blocker, P2 Explorer, Encrypted Disk Detector, and Dumplt. From the above most famous forensic software I have chosen, downloaded and installed PST Viewer (by Lepide Software Pvt. Ltd.) to evaluate and review its capabilities. The PST Viewer software is used to open and examine the Outlook PST files without requiring the MS Outlook; moreover it does not export the files (Forensic Control Limited, 2012). Features and Usage Guide In order to use the PST Viewer, you need to download and install it. The process of PST is straightforward; you need to follow the instructions on each and every step given in the software installation wizard. You are required to launch the software after its proper installation. In order to open the .pst files, you need to go to the file menu and click the open menu, and then locate the .pst file. The software will open the contents of the .pst file. One of the features of the PST Viewer that it has built-in search option helps to locate the file if you forgot the location of the .pst file. PST Viewer is an easy to use and self descriptive onlooker for PST files that facilitates to look through the contents of an Outlook mail store even not requiring the Outlook installed on the system. The GUI of the software is user-friendly that does not require technical expertise to use. The PST Viewer enables to read the e-mailed messages, view connections and allows viewing all the folders of the MS Outlook including Inbox, Drafts, Outbox, Sent Items, and the archived folders even not stored in the system. The software provides read only access, therefore, it does not allow to export any content from the PST files. The PST viewer does not open the corrupted files neither it repairs them. Moreover, it does not facilitate to extract the messages and the attachments with the e-mails. Use in Forensic Analysis During forensic analysis and electronic detection examination, the PST files are significant, whereas, in some cases they are even critical, since the PST files are being used as one of the main storage means for e-mail in the organizations. Therefore, it is necessary to investigate the PST files to get any evidence. In this regard, the PST Viewer is one of the software for viewing and examining the contents of the MS Outlook. It is pertinent to consider a case of forensic analysis where some important e-mails have been received by one of the officer of an organization. The e-mails and contents are very significant for the organization for the upcoming projects. The available computer system at the time has not MS Outlook installed; moreover, the employee has left the organization, therefore, the investigating employees even does not know the location of the PST files. Now there are two difficulties mentioned above, the both can be solved by the standalone software, the PST Viewer for opening the PST files as well as it facilitates to the search the PST files as well. Fig- 2.1 – PST Viewer Main Window Fig- 2.2 – PST Viewer Search Window Reference List MaximumCompression, 2011. Lossless data compression. [online] Available at: [Accessed 21 September 2012] Alex, 2012. Forensics in Compression. [online] Available at: [Accessed 21 September 2012] Forensic Control Limited, 2012. Free Computer Forensic Tools. [online] Available at: [Accessed 23 September 2012] Harris, T., 2011. How File Compression Works. [online] Available at: [Accessed 22 September 2012] Read More