Probability of finding contraband from sampling sectorsIf we sample a disk a number of times (n) for a disk with a number of sectors (N) which contains a number of sectors of contraband data (M), what is the probability of finding the contraband in at least one of the sectors:
|
References
Ref: Garfinkel, Simson, Alex Nelson, Vassil Roussev and Douglas White, Using purpose-built functions and block hashes to enable small block and sub-file forensics, DFRWS 2010 Paper and Ref
Slides: Here