Unconventional Method of Accessing Files – An Automated Generation of its Input

Abstract

File Carving is an unconventional method of accessing files from disk. It is a technique of reassembling unordered mixed file fragments, without using files' metadata such as FAT, for reconstructing the actual files present on the disk. In the areas of data recovery and digital forensics this situation arises. A challenge file is an input file for testing a file carving tool during its development phase and it consists of a number of files, in the form of fragments, mixed in random order [1]. In this paper authors have presented a software system that generates a challenge file by implementing, at user level, a file system which broadly follows FAT file system. This software system uses a large size file to store file fragments just like a kernel level file system uses disk to store files. The designers of file carvers can use the challenge file conveniently as a virtual disk, in place of the actual disk, thus eliminating the need of a physical hard disk for testing their algorithms. The kernel level file system fragments the file, as per availability of free clusters, at the time of creation or modification of files. The user level file system, fragments the file, as per availability of free clusters, on the virtual disk i.e., the challenge file. This challenge file consists of mixed file fragments of a number of user files. There are a number of other benefits of this approach as outlined in this paper.