Identifying Non-Volatile Data Storage Areas: Unique Notebook Identification Information as Digital Evidence
 

Nikica Budimir
Centre of Excellence in Defence Industry Systems Capability
University of South Australia,
Mawson Lakes, South Australia
Australia
budny001@students.unisa.edu.au

Jill Slay
Centre of Excellence in Defence Industry Systems Capability
University of South Australia,
Mawson Lakes, South Australia
Australia
Jill.slay@unisa.edu.au
 

ABSTRACT

The research reported in this paper introduces new techniques to aid in the identification of recovered notebook computers so they may be returned to the rightful owner. We identify non-volatile data storage areas as a means of facilitating the safe storing of computer identification information. A forensic proof of concept tool has been designed to test the feasibility of several storage locations identified within this work to hold the data needed to uniquely identify a computer. The tool was used to perform the creation and extraction of created information in order to allow the analysis of the non-volatile storage locations as valid storage areas capable of holding and preserving the data created within them. While the format of the information used to identify the machine itself is important, this research only discusses the insertion, storage and ability to retain such information.

Keywords:  unique identification; non-volatile storage areas; BIOS; MBR; notebook identification; digital evidence; forensic computing