Resurrection: A Carver for Fragmented Files

Martin Lambertz; Rafael Uetz; Elmar Gerhards-Padilla

Digital Forensics and Cyber Crime. Fifth International Conference, ICDF2C 2013, Moscow, Russia, September 26-27, 2013, Revised Selected Papers

Research Article

Resurrection: A Carver for Fragmented Files

Download

575 downloads

Cite: BibTeX Plain Text

@INPROCEEDINGS{10.1007/978-3-319-14289-0_5,
    author={Martin Lambertz and Rafael Uetz and Elmar Gerhards-Padilla},
    title={Resurrection: A Carver for Fragmented Files},
    proceedings={Digital Forensics and Cyber Crime. Fifth International Conference, ICDF2C 2013, Moscow, Russia, September 26-27, 2013, Revised Selected Papers},
    proceedings_a={ICDF2C},
    year={2015},
    month={2},
    keywords={File carving Multimedia forensics Fragmented files JPEGs},
    doi={10.1007/978-3-319-14289-0_5}
}

Martin Lambertz
Rafael Uetz
Elmar Gerhards-Padilla
Year: 2015
Resurrection: A Carver for Fragmented Files
ICDF2C
Springer
DOI: 10.1007/978-3-319-14289-0_5

Martin Lambertz¹^,*, Rafael Uetz¹^,*, Elmar Gerhards-Padilla¹^,*

1: Fraunhofer FKIE

*Contact email: martin.lambertz@fkie.fraunhofer.de, rafael.uetz@fkie.fraunhofer.de, elmar.gerhards-padilla@fkie.fraunhofer.de

Abstract

The recovery of deleted files is an important task frequently carried out by professionals in digital forensics and data recovery. When carried out without information from the file system, this process is called file carving. The techniques implemented in today’s file carvers are mostly sufficient for non-fragmented files. Fragmented files, on the contrary, are not well supported. In this paper we present a general process model for the recovery of fragmented files. This model is then applied to the JPEG file format which is the de facto standard for digital photographs. Moreover, we evaluate popular open source carvers and compare them with our proposed approach.

Keywords: File carving Multimedia forensics Fragmented files JPEGs

Published: 2015-02-06
Appears in: SpringerLink

: http://dx.doi.org/10.1007/978-3-319-14289-0_5