Research Article
Resurrection: A Carver for Fragmented Files
691 downloads
@INPROCEEDINGS{10.1007/978-3-319-14289-0_5, author={Martin Lambertz and Rafael Uetz and Elmar Gerhards-Padilla}, title={Resurrection: A Carver for Fragmented Files}, proceedings={Digital Forensics and Cyber Crime. Fifth International Conference, ICDF2C 2013, Moscow, Russia, September 26-27, 2013, Revised Selected Papers}, proceedings_a={ICDF2C}, year={2015}, month={2}, keywords={File carving Multimedia forensics Fragmented files JPEGs}, doi={10.1007/978-3-319-14289-0_5} }- Martin Lambertz
Rafael Uetz
Elmar Gerhards-Padilla
Year: 2015
Resurrection: A Carver for Fragmented Files
ICDF2C
Springer
DOI: 10.1007/978-3-319-14289-0_5
Abstract
The recovery of deleted files is an important task frequently carried out by professionals in digital forensics and data recovery. When carried out without information from the file system, this process is called file carving. The techniques implemented in today’s file carvers are mostly sufficient for non-fragmented files. Fragmented files, on the contrary, are not well supported. In this paper we present a general process model for the recovery of fragmented files. This model is then applied to the JPEG file format which is the de facto standard for digital photographs. Moreover, we evaluate popular open source carvers and compare them with our proposed approach.
Copyright © 2013–2024 ICST
