Towards an Engineering Approach to File Carver Construction

Aronson, Leon; Bos, Jeroen van den

doi:10.1109/compsacw.2011.68

Cited by 14 publications

(7 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The previous studies for the hidden data recovery investigated how to search and extract artifacts of deleted data upon unallocated storage space of camera devices and how to assemble found fragments [3,9]. Most of previous studies [10][11][12][13][14][15] have employed the carving technique that searches exhaustedly artifacts of deleted files upon unallocated storage space of camera systems. For more efficient searching operation, some of them [13][14][15] utilized a specific unique header and a footer signature of deleted data format.…”

Section: Corrupted Partially Recoveredmentioning

confidence: 99%

Extraction of Creation-Time for Recovered Files on Windows FAT32 File System

2019

View full text Add to dashboard Cite

In this article, we propose a creation order reconstruction method of deleted files for the FAT32 file system with Windows operating systems. Creation order of files is established using a correlation between storage locations of the files and their directory entry locations. This method can be utilized to derive the creation-time bound of files recovered without the creation-time information. In this article, we first examine the file allocation behavior of Windows FAT32 file system. Next, based on the examined behavior, we propose a novel method that finds the creation order of deleted files after being recovered without the creation-time information. Due to complex behaviors of Windows FAT32 file system, the method may find multiple creation orders although the actual creation order is unique. In experiments with a commercial device, we confirm that the actual creation order of each recovered file belongs to one of the creation orders found by the method.

show abstract

Section: Corrupted Partially Recoveredmentioning

confidence: 99%

Extraction of Creation-Time for Recovered Files on Windows FAT32 File System

2019

View full text Add to dashboard Cite

show abstract

“…Many tools and methods can be used to create and analyze memory dumps. We obtain the target memory dump of a Virtual Machine (VM) created using Oracle's Virtual Box 6 . Then, the RAM pages are investigated to carve PDF's textual data objects, see Figure 2.…”

Section: Step 1: Carving Pdf Objectsmentioning

confidence: 99%

“…File recovery and carving are popular approaches used in DF to reconstruct files [6]. File recovery techniques utilize the metadata of the underlying file system to recover files.…”

Section: Introductionmentioning

confidence: 99%

Carving and Clustering Files in Ram for Memory Forensics

Al-Sharif¹,

Al-Khalee²,

Al-Saleh³

et al. 2018

FJEC

View full text Add to dashboard Cite

Memory contains vital information about the current state of a system such as processes, network connections and opened files. The contents of a file can be reconstructed from memory either by following the Operating System's data structures (which might not be always available) or by carving data based on the file's internal structure. Unfortunately, the problem gets more complicated when carving several files with the same internal structure that happen to coexist in memory. This paper carves chunks of a certain file type from memory and employs clustering techniques to distribute these chunks into their corresponding files. As a running example, we carve and cluster different PDF files. The paper employs the wording similarities among related portions and shows that the Hierarchical clustering algorithm facilitates grouping of the recovered text pieces within an adequate accuracy.

show abstract

“…In order to make the trade-off between precision and runtime performance configurable we have implemented three model-transformations on Derric descriptions, based on an analysis of validation techniques in file carving [3]. Each transformation removes constraints so that more permissive specifications are obtained.…”

Section: Transforming Derric Modelsmentioning

confidence: 99%

Domain-Specific Optimization in Digital Forensics

Bos

Storm

2012

Theory and Practice of Model Transformations

View full text Add to dashboard Cite

Abstract. File carvers are forensic software tools used to recover data from storage devices in order to find evidence. Every legal case requires different trade-offs between precision and runtime performance. The resulting required changes to the software tools are performed manually and under the strictest deadlines. In this paper we present a model-driven approach to file carver development that enables these trade-offs to be automated. By transforming high-level file format specifications into approximations that are more permissive, forensic investigators can trade precision for performance, without having to change source. Our study shows that performance gains up to a factor of three can be achieved, at the expense of up to 8% in precision and 5% in recall.

show abstract

Towards an Engineering Approach to File Carver Construction

Cited by 14 publications

References 10 publications

Extraction of Creation-Time for Recovered Files on Windows FAT32 File System

Extraction of Creation-Time for Recovered Files on Windows FAT32 File System

Carving and Clustering Files in Ram for Memory Forensics

Domain-Specific Optimization in Digital Forensics

Contact Info

Product

Resources

About