Carving contiguous and fragmented files with fast object validation

Authors:
Simson L. Garfinkel
Affiliations:
Naval Postgraduate School, Monterey, CA, USA and Center for Research on Computation and Society, School of Engineering and Applied Sciences, Harvard University, Cambridge, MA, USA
Venue:
Digital Investigation: The International Journal of Digital Forensics & Incident Response
Year:
2007

Citing 1
Cited 11

A large-scale study of file-system contents

SIGMETRICS '99 Proceedings of the 1999 ACM SIGMETRICS international conference on Measurement and modeling of computer systems

Advanced JPEG carving

Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop
An Empirical Analysis of Disk Sector Hashes for Data Carving

Journal of Digital Forensic Practice
Fragmentation Point Detection of JPEG Images at DHT Using Validator

FGIT '09 Proceedings of the 1st International Conference on Future Generation Information Technology
Making sense of unstructured flash-memory dumps

Proceedings of the 2010 ACM Symposium on Applied Computing
Bringing domain-specific languages to digital forensics

Proceedings of the 33rd International Conference on Software Engineering
mCarve: Carving attributed dump sets

SEC'11 Proceedings of the 20th USENIX conference on Security
Advanced carving techniques

Digital Investigation: The International Journal of Digital Forensics & Incident Response
On metadata context in Database Forensics

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Domain-Specific optimization in digital forensics

ICMT'12 Proceedings of the 5th international conference on Theory and Practice of Model Transformations
Classification and Recovery of Fragmented Multimedia Files using the File Carving Approach

International Journal of Mobile Computing and Multimedia Communications
Photo forensics on shanzhai mobile phone

WASA'13 Proceedings of the 8th international conference on Wireless Algorithms, Systems, and Applications

Quantified Score

Hi-index	0.00

Visualization

Abstract

''File carving'' reconstructs files based on their content, rather than using metadata that points to the content. Carving is widely used for forensics and data recovery, but no file carvers can automatically reassemble fragmented files. We survey files from more than 300 hard drives acquired on the secondary market and show that the ability to reassemble fragmented files is an important requirement for forensic work. Next we analyze the file carving problem, arguing that rapid, accurate carving is best performed by a multi-tier decision problem that seeks to quickly validate or discard candidate byte strings - ''objects'' - from the media to be carved. Validators for the JPEG, Microsoft OLE (MSOLE) and ZIP file formats are discussed. Finally, we show how high speed validators can be used to reassemble fragmented files.