Performance Analysis of File Carving Tools

Laurenson, Thomas

doi:10.1007/978-3-642-39218-4_31

Cited by 15 publications

(5 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This method is used to recover files from the unallocated spaces of a storage, for instance, in digital forensics. It can identify files embedded in unknown binary data by techniques such as searching file headers and using file structures [12]. We used Foremost 9 in this evaluation because it is used in general and open source program.…”

Section: Methodsmentioning

confidence: 99%

Threat Analysis of Poisoning Attack Against Ethereum Blockchain

Sato¹,

Imamura²,

Omote³

2020

Information Security Theory and Practice

View full text Add to dashboard Cite

In recent years, blockchain technology has witnessed remarkable developments in its application to crypto assets (cryptocurrency) considering not only function storing values but also extension of the smart contract and anonymity improvement. Ethereum is a blockchain that features the smart contract and there is a data space, where programs can be freely stored, on the blockchain. However, pollution of such data space can jeopardize the existence of Ethereum.In this study, we analyze the fact that the malicious files that are stored in the data space of Ethereum and discuss "blockchain poisoning attacks" that significantly contaminate the blockchains by embedding malicious data at a relatively lower cost. We try to tackle Ethereum-specific risks which are not mentioned in previous study. In addition, we empirically examine the possibility of a poisoning attack on a private blockchain network.

show abstract

Section: Methodsmentioning

confidence: 99%

Threat Analysis of Poisoning Attack Against Ethereum Blockchain

Sato¹,

Imamura²,

Omote³

2020

Information Security Theory and Practice

View full text Add to dashboard Cite

show abstract

“…When a digital data recovery process is performed, real files are generated. However files that are incorrect or corrupted can be generated, named false positives [14]. False positives are files that never existed and that can be generated in large numbers.…”

Section: Data Carving Limitations: False Positivesmentioning

confidence: 99%

Dejavu Forensic: Using Support Vector Machine to Improve Recovery Results for Formatted Data in JPEG and PNG Extensions

Bezerra,

de Lima,

Silva

2024

Preprint

View full text Add to dashboard Cite

Background: In line with technological advances, virtual crimes have a greater tendency to occur. The most routine situations are: cyberbullying and illicit sharing, but cases of invasion of privacy, dissemination of defamatory emails and child pornography also occur. When digital equipment is stolen, lost or disposed of, data is still stored on disks. This factor enables the recovery of this file. Objective: The main focus of this article is the recovery of formatted files. The applicability of Foremost, Scalpel and Magic Rescue tools in the Linux environment is investigated. In addition, an authorial tool, equipped with machine learning, is used. The general objective of this research is to develop a recovery and validation tool for formatted files. The project aims to contribute to investigations of digital and cyber crimes. In addition to demonstrating knowledge, it brings new perceptions of analysis with regard to recovery methods for formatted files. Methods: Using the pattern recognition methodology, the cluster is used as input, which, through the histogram, acts as an input neuron of the learning machine. This work applies machine learning aiming at recognizing the pattern of the blocks/clusters. In the first scenario, here named “simple”, the classification is binary. There is only class vs. counterclass. This methodology was developed by Pavel (2017) and replicated in the aforementioned simple scenario. In a second scenario, named “complex”, the one-against-all method was used, whose database contains 16,000 files. Results: This research presents a cutting-edge approach that synergizes machine learning and data science to recover formatted data. Our innovative tool boasts a remarkable recovery rate of over 96% for formatted PNG and JPEG files, running in just a few seconds. This breakthrough holds significant promise for improving digital forensic investigations. Conclusions: The experiences declared in the proposed work leave contributions for the advancement in studies about data recovery. Its relevance concerns the proposal to assist in the elucidation of digital crimes that surround the society of digital natives. The authorial system becomes a locus of how technology can serve human rights and improve the quality of life in contemporary society.

show abstract

“…No trabalho de [Laurenson 2013] pode-se notar que o número de arquivos falsopositivos gerados após o processo de recuperação de dadosé bastante elevado e, dependendo da ferramenta utilizada, esse número pode ser ainda maior. Para aárea Forense essaé uma preocupação bastante relevante, pois a recuperação de dadosé algo que os profissionais daárea lidam diariamente, seja recuperando fotos ou documentos em discos rígidos, ou outro tipo de armazenamento não volátil.…”

Section: Trabalhos Relacionadosunclassified

“…No entanto, quandoé realizado um processo de recuperação de dados digitais, podem ser gerados, além dos arquivos reais, arquivos que são incorretos ou corrompidos, denominados de falso-positivos [Laurenson 2013]. Quanto maior a quantidade de falso-positivos ao final do procedimento de recuperação, maior será o esforço e o tempo necessários para separá-los dos arquivos reais, adicionando, dessa forma, dificuldades no trabalho de pesquisadores e profissionais daárea Forense.…”

Section: Introductionunclassified

Análise de Métodos para o Tratamento de Arquivos Falso-Positivos a partir de Ferramentas de Recuperação de Dados Digitais: Uma Revisão Sistemática da Literatura

Pereira¹,

Silva²,

Bezerra³

et al. 2019

Anais Do VIII Workshop De Forense Computacional (WFC 2019)

View full text Add to dashboard Cite

O desenvolvimento da tecnologia tem gerado informações que precisam de armazenamento na forma de arquivos digitais, necessitando, assim, de dispositivos secundários. No entanto, esses arquivos podem ser deletados de forma intencional ou por acidente, motivando a sua recuperação. No processo de recuperação de dados em mídias digitais, além de recuperar os arquivos desejados, também são gerados arquivos denominados de falso-positivos. Este trabalho tem o objetivo de apresentar os resultados de uma Revisão Sistemática da Literatura sobre a recuperação de dados digitais por meio de análise de ferramentas utilizadas nesse processo, bem como de técnicas e métodos usados no tratamento dos arquivos falso-positivos.

show abstract

Performance Analysis of File Carving Tools

Cited by 15 publications

References 15 publications

Threat Analysis of Poisoning Attack Against Ethereum Blockchain

Threat Analysis of Poisoning Attack Against Ethereum Blockchain

Dejavu Forensic: Using Support Vector Machine to Improve Recovery Results for Formatted Data in JPEG and PNG Extensions

Análise de Métodos para o Tratamento de Arquivos Falso-Positivos a partir de Ferramentas de Recuperação de Dados Digitais: Uma Revisão Sistemática da Literatura

Contact Info

Product

Resources

About