Computer Forensics Technologies for Personally Identifiable Information Detection and Audits

摘要

A fundamental strength of forensics tools when used for detecting sensitive information is that they can recover deleted files and embedded images, list all alternate streams for each file, and perform signature analysis before conducting a search for sensitive information. A search using forensics tools not only checks the file content, but also examines file slack, metadata, links and other content. As a result, forensics tools are capable of discovering more information than the PII detection tools that were evaluated. They provide an additional source of information by which a PII search can become more effective and uncover more potential sources of PII.