Computer Geolocation Using Extracted Features

Chad M.S. Steel
Virginia Polytechnic Institute and State University
Falls Church, VA USA
csteel13@vt.edu

Abstract

This paper compares the extracted feature data from a sample set of hard drive images in an effort to relate the features to the physical location of the drive.  A list of probable zip codes, phone numbers, place names, and IP addresses are extracted from raw drive images and compared to manually identified geolocation data.  The results of the individual extractions are then analyzed to determine the feasibility in using automated extraction and analysis techniques for geolocating hard drives.

Keywords:  hard disk forensics, geocoding, geolocation