Abstract
File carving is a technique whereby data files are extracted from a digital device without the assistance of file tables or other disk meta-data. One of the primary challenges in file carving can be found in attempting to recover files that are fragmented. In this paper, we show how detecting the point of fragmentation of a file can benefit fragmented file recovery. We then present a sequential hypothesis testing procedure to identify the fragmentation point of a file by sequentially comparing adjacent pairs of blocks from the starting block of a file until the fragmentation point is reached. By utilizing serial analysis we are able to minimize the errors in detecting the fragmentation points. The performance results obtained from the fragmented test-sets of DFRWS 2006 and 2007 show that the method can be effectively used in recovery of fragmented files.
| Original language | English (US) |
|---|---|
| Title of host publication | DFRWS 2008 Annual Conference |
| State | Published - 2008 |
| Event | 8th Annual Digital Forensic Research Workshop, DFRWS 2008 - Baltimore, MD, United States Duration: Aug 11 2008 → Aug 13 2008 |
Other
| Other | 8th Annual Digital Forensic Research Workshop, DFRWS 2008 |
|---|---|
| Country/Territory | United States |
| City | Baltimore, MD |
| Period | 8/11/08 → 8/13/08 |
Keywords
- Data recovery
- DFRWS carving challenge
- File carving
- Forensics
- Fragmentation
- Hypothesis testing
- Sequential
ASJC Scopus subject areas
- Information Systems