Retention of micro-fragments in cluster slack - A first model

Garcia, Johan; Holleboom, Thijs Jan

doi:10.1109/wifs.2009.5386487

Cited by 3 publications

(7 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…which was derived in [12] and here given in a somewhat different, more compact form. As in the case of uniformly distributed file sizes this expression is not adequate to be used for calculating the expected number of end-file clusters because the number of files depends on the number of allocated clusters per file.…”

Section: Exponentially Decreasing Probability Distributionmentioning

confidence: 99%

“…In [12] a terminology was introduced which also will be used in the analysis below. We start with defining the necessary terms, largely following [12].…”

Section: Analytical Modelingmentioning

confidence: 99%

“…This procedure improves the accuracy of the model, especially for small file sizes. In the following sections expressions for the same three file size distributions considered in [12] are given.…”

Section: N N=1mentioning

confidence: 99%

“…The number of end-file clusters produced by filling an area of size D with files the sizes of which are uniformly distributed can roughly be estimated by dividing D byS (u) , which is the approach followed in [12]. There are two sources of inaccuracies here that we will address.…”

Section: Uniformly Distributed File Sizesmentioning

confidence: 99%

“…The constant b is a characteristic of the distribution whereas a is a normalization constant such that L2 n=L1 p (e) n = 1 (12) implying that…”

Section: Exponentially Decreasing Probability Distributionmentioning

confidence: 99%

See 4 more Smart Citations

Fragment retention characteristics in slack space — Analysis and measurements

Holleboom

Garcia

2010

2010 2nd International Workshop on Security and Communication Networks (IWSCN)

Self Cite

View full text Add to dashboard Cite

When files are deleted, their information is not removed from the storage media. This is a well known fact, and there exist numerous undelete utilities to recover newly deleted files. When deleted files have been partly overwritten, the data from the part of the file that remains in unallocated space can be readily extracted by file carving. Such carving is often performed in forensic investigations. Furthermore, as a consequence of file system implementation specifics, there additionally exist small remains of the previous files in the space at the end of new files. In this paper we focus on these small remains of previous files, or micro-fragments, that exist even after all the space allocated to the previous file has been reallocated to new files. We derive expressions for modeling the number of micro-fragments that can be expected to be found, and perform experiments to evaluate the analytical model. The obtained results indicate good correspondence between the analytical predictions and the measured results.

show abstract

Section: Exponentially Decreasing Probability Distributionmentioning

confidence: 99%

“…In [12] a terminology was introduced which also will be used in the analysis below. We start with defining the necessary terms, largely following [12].…”

Section: Analytical Modelingmentioning

confidence: 99%

Section: N N=1mentioning

confidence: 99%

Section: Uniformly Distributed File Sizesmentioning

confidence: 99%

“…The constant b is a characteristic of the distribution whereas a is a normalization constant such that L2 n=L1 p (e) n = 1 (12) implying that…”

Section: Exponentially Decreasing Probability Distributionmentioning

confidence: 99%

See 3 more Smart Citations