DID YOU KNOW? DTIC has over 3.5 million final reports on DoD funded research, development, test, and evaluation activities available to our registered users. Click
HERE to register or log in.
Accession Number:
ADA576165
Title:
Carving Contiguous and Fragmented Files with Fast Object Validation
Descriptive Note:
Journal article
Corporate Author:
NAVAL POSTGRADUATE SCHOOL MONTEREY CA
Report Date:
2007-01-01
Pagination or Media Count:
12.0
Abstract:
File carving reconstructs files based on their content, rather than using metadata that points to the content. Carving is widely used for forensics and data recovery, but no file carvers can automatically reassemble fragmented files. We survey files from more than 300 hard drives acquired on the secondary market and show that the ability to reassemble fragmented files is an important requirement for forensic work. Next we analyze the file carving problem, arguing that rapid, accurate carving is best performed by a multi-tier decision problem that seeks to quickly validate or discard candidate byte strings - objects - from the media to be carved. Validators for the JPEG, Microsoft OLE MSOLE and ZIP file formats are discussed. Finally, we show how high speed validators can be used to reassemble fragmented files.
Distribution Statement:
APPROVED FOR PUBLIC RELEASE