HVEA-SIFTING: Dependency-Driven Selective Acquisition and Negative-Space Auditing for Defensible Windows Forensic Imaging

Background/Objectives: Full-disk imaging remains the default in digital forensics, yet the forensically relevant fraction of modern storage is small, making exhaustive acquisition increasingly costly. Existing selective-imaging methods reduce this cost but determine relevance using flat criteria such as file type, disk region, or investigator choice, and they provide no systematic account of the vast majority of the disk they omit. This paper introduces HVEA-SIFTING, a four-phase selective-preservation pipeline that operates on an already-acquired full forensic image and uses the High-Value Evidence Area (HVEA) dependency model as its selection basis. Methods: HVEA-SIFTING selects artifacts through a static, multi-tier path-predicate mapping in evidentiary-dependency order so that each preserved item is interpretable in the context established by its predecessors, and it is paired with a reproducible negative-space audit, a deterministic file-level classification of every omitted entry, addressing the soundness concern that a partial image’s defensibility depends as much on what it omits as on what it preserves. The method was evaluated on nine Windows images spanning XP, Vista, and Windows 11, eight drawn from the public M57-Patents corpus. Results: HVEA-SIFTING reduced acquired volume by 89.0 to 97.4% (mean 92.3%) at bit-for-bit integrity, preserved 100% of recoverable targeted artifacts with zero genuine misses, and populated all ten HVEA layers on every image. The negative-space audit found no user-authored content among hundreds of thousands of omitted entries. Conclusions: Independent expert review supported the method’s forensic defensibility for triage and resource-constrained acquisition.