Accession Number:

ADA576165

Title:

Carving Contiguous and Fragmented Files with Fast Object Validation

Descriptive Note:

Journal article

Corporate Author:

NAVAL POSTGRADUATE SCHOOL MONTEREY CA

Personal Author(s):

• Garfinkel, Simson L.

Report Date:

2007-01-01

Pagination or Media Count:

12.0

Abstract:

File carving reconstructs files based on their content, rather than using metadata that points to the content. Carving is widely used for forensics and data recovery, but no file carvers can automatically reassemble fragmented files. We survey files from more than 300 hard drives acquired on the secondary market and show that the ability to reassemble fragmented files is an important requirement for forensic work. Next we analyze the file carving problem, arguing that rapid, accurate carving is best performed by a multi-tier decision problem that seeks to quickly validate or discard candidate byte strings - objects - from the media to be carved. Validators for the JPEG, Microsoft OLE MSOLE and ZIP file formats are discussed. Finally, we show how high speed validators can be used to reassemble fragmented files.

Descriptors:

• *FILES(RECORDS)
• *FRAGMENTATION
• *VALIDATION
• DECOMPRESSION
• METADATA
• SEMANTICS
• SURVEYS

Subject Categories:

• Information Science
• Ballistics

Distribution Statement:

APPROVED FOR PUBLIC RELEASE