Date Added: Feb 2011
In this paper, the authors describe the problem of checking the integrity of a hard disk for forensics investigation after the computer of a suspect has been seized. Existing solutions do not provide a satisfactory solution to solve the problem. They either require a huge amount of storage to store the hash values of the sectors or may not be able to cope with the situation in an effective way in case some sectors have been changed (e.g. become bad sectors or deleted due to being part of the Legal Professional Privilege items).