No abstract

No abstract

No abstract

Digital Forensic Analyst encounters a mixed file fragments in the absence of File Table information i.e., files" metadata. File Carving is a process of reconstructing files from mixed file fragments without using files" metadata. File Carving is an interesting and challenging problem in digital forensics and Data Recovery. Recently there have been number of research papers in the area of File Carving. In this paper authors describe File Carving and present its Literature Survey. The implementation of Greedy Sequential Unique Path File Carving algorithm for 4-bit bitmap files, with the help of function prototypes using C language and brief explanation of these prototypes is explained. The experimental results are also shown. The experimental results show that the files can be reconstructed from their fragments without knowing files" metadata. However there are limitations of these methods as mentioned in section 5.

File Carving is an unconventional method of accessing files from disk. It is a technique of reassembling unordered mixed file fragments, without using files' metadata such as FAT, for reconstructing the actual files present on the disk. In the areas of data recovery and digital forensics this situation arises. A challenge file is an input file for testing a file carving tool during its development phase and it consists of a number of files, in the form of fragments, mixed in random order [1]. In this paper authors have presented a software system that generates a challenge file by implementing, at user level, a file system which broadly follows FAT file system. This software system uses a large size file to store file fragments just like a kernel level file system uses disk to store files. The designers of file carvers can use the challenge file conveniently as a virtual disk, in place of the actual disk, thus eliminating the need of a physical hard disk for testing their algorithms. The kernel level file system fragments the file, as per availability of free clusters, at the time of creation or modification of files. The user level file system, fragments the file, as per availability of free clusters, on the virtual disk i.e., the challenge file. This challenge file consists of mixed file fragments of a number of user files. There are a number of other benefits of this approach as outlined in this paper.