A Comprehensive Literature Review of File Carving

Poisel, Rainer; Tjoa, Simon

doi:10.1109/ares.2013.62

Cited by 25 publications

(9 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our study belongs to the category of hidden data recovery. The previous studies for the hidden data recovery investigated how to search and extract artifacts of deleted data upon unallocated storage space of camera devices and how to assemble found fragments [3,9]. Most of previous studies [10][11][12][13][14][15] have employed the carving technique that searches exhaustedly artifacts of deleted files upon unallocated storage space of camera systems.…”

Section: Corrupted Partially Recoveredmentioning

confidence: 99%

Extraction of Creation-Time for Recovered Files on Windows FAT32 File System

2019

View full text Add to dashboard Cite

In this article, we propose a creation order reconstruction method of deleted files for the FAT32 file system with Windows operating systems. Creation order of files is established using a correlation between storage locations of the files and their directory entry locations. This method can be utilized to derive the creation-time bound of files recovered without the creation-time information. In this article, we first examine the file allocation behavior of Windows FAT32 file system. Next, based on the examined behavior, we propose a novel method that finds the creation order of deleted files after being recovered without the creation-time information. Due to complex behaviors of Windows FAT32 file system, the method may find multiple creation orders although the actual creation order is unique. In experiments with a commercial device, we confirm that the actual creation order of each recovered file belongs to one of the creation orders found by the method.

show abstract

Section: Corrupted Partially Recoveredmentioning

confidence: 99%

Extraction of Creation-Time for Recovered Files on Windows FAT32 File System

2019

View full text Add to dashboard Cite

show abstract

“…Multiple-type files contains many file types. In order to achieve a variety of file types to assemble at the same time, we use the method of Parallel Unique Path (PUP) [14], it means multiple-type files to detect their subsequent data cluster at the same time. PUP is described below: By file header signature detected K file header and put them into the beginning of K linked list, each linked list is a reconstruction path stored a file.…”

Section: Support Vector Machinementioning

confidence: 99%

Research of Multiple-type Files Carving Method Based on Entropy

Guo¹,

He²,

Huang³

2016

Proceedings of the 2015 4th National Conference on Electrical, Electronics and Computer Engineering

View full text Add to dashboard Cite

Abstract. File carving is a technique of recovering data from disk without depending on the File System, and the key step is the extraction and reassembly of file fragments. Efficient recognition and extraction of file fragments is not only the prerequisite of recovering file, but also the guarantee of a low false positive rate and high accuracy Digital Forensics. In this paper, when the entropy of file fragments is low, the validation algorithms I used for the extraction are header/footer validation and entropy feature extraction validation, but when the entropy of file fragments is high, besides the previous two algorithms I introduced Bloom filter feature extraction validation, byte frequency distribution (BFD) feature extraction validation and support vector machine (SVM) with supervised learning ability to detect the type of file fragments. After the extraction, I used Parallel Unique Path (PUP) for the reassembly of file fragments. I used DFRWS 2007 carving challenge data set to test my method and the result is better than only using entropy to classify multiple-type files especially in the case of high entropy.

show abstract

“…File carving [17,18] and timestamps are two key concepts in digital forensics. Unfortunately both concepts are laden with complex operations and a large amount of uncertainty regarding the correctness of the results.…”

Section: Introductionmentioning

confidence: 99%

Disk Cluster Allocation Behavior in Windows and NTFS

2019

View full text Add to dashboard Cite

The allocation algorithm of a file system has a huge impact on almost all aspects of digital forensics, because it determines where data is placed on storage media. Yet there is only basic information available on the allocation algorithm of the currently most widely spread file system; NTFS. We have therefore studied the NTFS allocation algorithm and its behavior empirically. To do that we used two virtual machines running Windows 7 and 10 on NTFS formatted fixed size virtual hard disks, the first being 64 GiB and the latter 1 TiB in size. Files of different sizes were written to disk using two writing strategies and the $Bitmap files were manipulated to emulate file system fragmentation. Our results show that files written as one large block are allocated areas of decreasing size when the files are fragmented. The decrease in size is seen not only within files, but also between them. Hence a file having smaller fragments than another file is written after the file having larger fragments. We also found that a file written as a stream gets the opposite allocation behavior, i. e. its fragments are increasing in size as the file is written. The first allocated unit of a stream written file is always very small and hence easy to identify. The results of the experiment are of importance to the digital forensics field and will help improve the efficiency of for example file carving and timestamp verification. Keywords Digital forensics • File carving • Allocation algorithm • NTFS The research leading to these results has received funding from the Research Council of Norway programme IKTPLUSS, under the research and development project Ars Forensica grant agreement 248094/O70.

show abstract

A Comprehensive Literature Review of File Carving

Cited by 25 publications

References 41 publications

Extraction of Creation-Time for Recovered Files on Windows FAT32 File System

Extraction of Creation-Time for Recovered Files on Windows FAT32 File System

Research of Multiple-type Files Carving Method Based on Entropy

Disk Cluster Allocation Behavior in Windows and NTFS

Contact Info

Product

Resources

About