Forensic-Tool Requirements

• Hard disk/memory images are huge

  → code efficiency!

• Images may contain malicious code exploiting potential code vulnerabilities

  → memory safety

Rust Programming Language

code efficiency

• zero cost abstractions
• no garbage collector

memory safety

• data ownership

Hypothesis

Is the Rust ecosystem suitable for forensic tool development?

Method: Case study: Development of a GNU-strings alternative with multi-byte-encoding support

Demonstration

Combine UTF-16 Little-Endian and Big-Endian scanning and prevent false positives:

cat /dev/sda2  | ./stringsext -ci -tx \
                 -e UTF-16be,16,U+0..U+007f \
                 -e UTF-16be,30,U+20..U+2f,U+400..U+07ff \
                 -e UTF-16le,10,U+0..U+007f \
                 -e UTF-16le,30,U+20..U+2f,U+400..U+07ff \

Results

• [-] more bugs in young Rust libraries, but
• [+] Rust is memory safe and
• [+] bugs are much easier to detect than memory safety related vulnerabilities

→ Rust meets the requirements of forensic tool development