Cybersecurity Commons^™

Distributed File Carving, Brad J. Baudin

LSU Master's Theses

File carving is a fundamental technique in the digital forensics community, enabling analysts to recover deleted files from disk images without relying on filesystem metadata; however, as storage capacities continue to increase, modern file carving tools face significant scalability challenges, with carving time growing substantially alongside disk image size, particularly in the presence of file fragmentation. Fragmentation, a common behavior in modern filesystems, distributes file data across non-contiguous disk blocks to maximize space utilization, and in large disk images this distribution can span wide logical distances, increasing the search space and reducing carving efficiency, causing traditional approaches to struggle within …

Large-Scale File Fragment Classification Via Multi-View Learning, Samuel Hildebrand

LSU Master's Theses

File reassembly is one of the most fundamental tasks in digital forensics, enabling recovery of data from potentially damaged storage media even when file system metadata is unavailable. This thesis reviews more than two decades of work in the realm of file carving, with a particular focus on fragmented file carving, which remains a focus of research, and file fragment classification, a principal component of fragmented file carving. This thesis serves a literature review of both file carving and fragmented file carving, surveys the massive amounts of data needed for the task of fragment classification and the datasets that serve …

Recovery And Validation Of Fragmented Rar Files Through The Scalpel3 Application, Thomas L. Landaiche Iii

LSU Master's Theses

A core component of filesystems includes an address table or other means of tracking metadata on where a given file resides within a disk image. This is crucial for regular operation of a computer, or disk analysis in digital forensics. When filesystem information is missing or corrupted, locating saved files on a disk becomes challenging. Whether the disk was accidentally wiped or intentionally tampered with, data still present on the disk, even while untracked, can possibly be recovered beyond what the filesystem registers. File carving in digital forensics is important for these scenarios when data recovery is necessary but address …

From Network Packets To Physical Consequences: Network-Level Spoofing And Loss Of Visibility In Industrial Control Systems, Lillian B. Beck

LSU Master's Theses

Industrial Control Systems (ICS) are the foundation of critical infrastructure as they provide resources like clean water, electricity, and natural gas to support our everyday functions. Given their essential role in modern society, the failure or compromise of ICS systems can lead to significant negative consequences and public safety impacts. Understanding how these systems can be targeted and exploited by malicious actors is necessary to improve their security and resilience.

This research examines how an attacker could manipulate a real-world ICS network by targeting a fully functional Natural Gas (NG) Compressor Station Platform that emulates real operations. This research led …

Effects Of Code Scaffolding In Increasing Student Confidence In Programming Cryptography, John Denny

LSU Master's Theses

Cryptography is essential for secure communications, and new threats require more students willing to program and interact with cryptographic systems. Previous research is focused on tools for teaching these systems at a high level, teaching through attacks against these systems, and proper use of these systems in software development. In this paper, we seek to design a workshop to use scaffolded Python code to teach how these cryp- tographic systems are designed. We explore the use of code scaffolding for students to program an example implementation of the McEliece crypto- graphic system to build confidence in working with these systems. …

Exploring Runtime Evolution In Android: A Cross-Version Analysis And Its Implications For Memory Forensics., Babangida Bappah

LSU Master's Theses

Userland memory forensics has become a critical component of smartphone investigations and incident response, enabling the recovery of volatile evidence such as deleted messages from end-to-end encrypted apps and cryptocurrency transactions. However, these forensics tools, particularly on Android, face significant challenges in adapting to different versions and maintaining reliability over time due to the constant evolution of low-level structures critical for evidence recovery and reconstruction. Structural changes, ranging from simple offset modifications to complete architectural redesigns, pose substantial maintenance and adaptability issues for forensic tools that rely on precise structure interpretation. Thus, this paper presents the first systematic study of …

Digital Forensics And Ai: Artifact Analysis And Using Ai In The Forensics Domain, Clinton Joel Walker

LSU Doctoral Dissertations

Digital Forensics (DF) is a field of forensic science focusing on the acquisition, authentication, and analysis of digital evidence while maintaining integrity of that data. DF analysts use forensic tools to parse large volumes of data for investigations and depend on them for identification of pertinent digital evidence in vast amounts of data. Keeping up with innovations and ever-expanding data volumes is a constant challenge for these investigators. The prevalence of Artificial Intelligence (AI) in everyday computing is rapidly expanding, with the use of Machine Learning (ML) and Large Language Models (LLM)s becoming increasingly commonplace. Innovations in technology bring new …

Optimizing Llm X86 Assembly Code Comprehension Through Fine-Tuning, Darrin Michael Lea

LSU Master's Theses

Reverse engineering is a cybersecurity process that focuses on understanding the underlying functionality of software or malware. This is an arduous process that demands large amounts of time and effort from cybersecurity practitioners. Large Language Models (LLMs) offer a potential solution to this problem. LLMs have worked their way into various fields of cybersecurity in recent years, including incident response and malware classification. However, LLMs have historically struggled with low-level code comprehension: a necessary part of reverse engineering. While LLMs can generate code and explain its function on the surface level, they struggle to grasp the wider context. In this …