Abstract
The recovery of deleted files is an important task frequently carried out by professionals in digital forensics and data recovery. When carried out without information from the file system, this process is called file carving. The techniques implemented in today’s file carvers are mostly sufficient for non-fragmented files. Fragmented files, on the contrary, are not well supported. In this paper we present a general process model for the recovery of fragmented files. This model is then applied to the JPEG file format which is the de facto standard for digital photographs. Moreover, we evaluate popular open source carvers and compare them with our proposed approach.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsReferences
CCITT Recommendation T.81: Information technology - Digital compression and coding of continuous-tone still images - Requirements and guidelines. ISO/IEC 10918–1 (1992)
Digital Assembly - A smart choice for photo forensics. http://digital-assembly.com/products/adroit-photo-forensics/
Garfinkel, S.L.: Carving contiguous and fragmented files with fast object validation. Digital Inv. 4S, 2–12 (2007)
Shanmugasundaram, K., Memon, N.: Automatic reassembly of document fragments via context based statistical models. In: 19th Annual Computer Security Applications Conference, pp. 152–159. IEEE Computer Society, Las Vegas (2003)
Pal, A., Memon, N.: The evolution of file carving. IEEE Signal Process. Mag. 26(2), 59–71 (2009). IEEE
Memon, N., Pal, A.: Automated reassembly of file fragmented images using greedy algorithms. IEEE Trans. Image Process. 15(2), 385–393 (2006)
Pal, A., Sencar, H.T., Memon, N.: Detecting file fragmentation point using sequential hypothesis testing. Digital Inv. 5, 2–13 (2008)
Roussev, V., Garfinkel, S.L.: File classification fragment - the case for specialized approaches. In: Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering, pp. 3–14. IEEE Computer Society (2009)
Cohen M.I.: Advanced JPEG carving. In: 1st International ICST Conference on Forensic Applications and Techniques in Telecommunications, Information and Multimedia (2008)
Digital Forensics Tool Testing Images. http://dftt.sourceforge.net
DFRWS 2006 Forensics Challenge. http://www.dfrws.org/2006/challenge/
DFRWS 2007 Forensics Challenge. http://www.dfrws.org/2007/challenge/
Digital Corpora: Disk Images. http://digitalcorpora.org/corpora/disk-images
Garfinkel, S.L., Farrell, P., Roussev, V., Dinolt, G.: Bringing science to digital forensics with standardized forensic corpora. Digital Inv. 6, S2–S11 (2009)
Mikus, N.: An Analysis of Disc Carving Techniques. Master’s thesis, Naval Postgraduate School, Monterey, California (2005)
Richard III, G.G., Roussev, V.: Scalpel: a frugal, high performance file carver. In: 2005 Digital Forensics Research Workshop (2005)
PhotoRec - CGSecurity. http://www.cgsecurity.org/wiki/PhotoRec
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
About this paper
Cite this paper
Lambertz, M., Uetz, R., Gerhards-Padilla, E. (2014). Resurrection: A Carver for Fragmented Files. In: Gladyshev, P., Marrington, A., Baggili, I. (eds) Digital Forensics and Cyber Crime. ICDF2C 2013. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 132. Springer, Cham. https://doi.org/10.1007/978-3-319-14289-0_5
Download citation
DOI: https://doi.org/10.1007/978-3-319-14289-0_5
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-14288-3
Online ISBN: 978-3-319-14289-0
eBook Packages: Computer ScienceComputer Science (R0)