File Carving Survey on Techniques, Tools and Areas of Use
DOI:
https://doi.org/10.14738/tnc.81.7636Keywords:
Digital Forensics, Data Recovery, Multimedia File Carving, Data Carving, File Carving Tools.Abstract
In digital and computer forensics, file carving is a very hot research topic. That is the main reason why the research is needed to be focused on improving file carving techniques, so that digital investigation can obtain important data and evidence from damaged or corrupted storage media. In the digital forensic investigation, analyzing the unallocated space of storage media is necessary to extract the deleted or pre-written files when the file system metadata is missing or corrupted. Data carving can be defined as a method to recover the file from unallocated space based on different factors such as file type, information of the file (Header/Footer), or the contents of the file. Research in this area focuses on technological improvements in terms of tools and techniques over the past years. The studies examine different techniques of data carving, especially multimedia files (eg. images and videos). The work file carving is classified into three categories classic carving techniques, intelligent carving techniques and smart carving techniques. Moreover, there are seven popular multimedia carving tools that are mostly used and experimentally evaluated are presented. We conclude that proposing new advanced method for carving multimedia files still open and new direction for future research. This is because the fragmentations and compression are very commons used and useful for these kind of files.
References
[2]. C. Walter, “Kryder’s law” (2005, July) http://www.scientificamerican.com/article.cfm?id=kryders-law. Scientific American. [Online; Status: October 15th 2011].Teng, T., M. Lefley, and D. Claremont, Progress towards automated diabetic ocular screening: A review of image analysis and intelligent systems for diabetic retinopathy. Medical and Biological Engineering and Computing, 2002. 40(1): p. 2-13.
[3]. German Federal Ministry of the Interior, “Polizeiliche Kriminalstatistik 2010,” http://www.bmi.bund.de/ SharedDocs/Downloads/DE/Broschueren/2011/PKS2010.html, May 2010, [Online; Status: October 6th 2011].
[4]. R. Poisel and S. Tjoa, “Roadmap to approaches for carving of fragmented multimedia files,” in Proc. of the 4th International Workshop on Digital Forensics (WSDF’11), Vienna, Austria. IEEE, August 2011, pp. 752–757.Haddouche, A., et al., Detection of the foveal avascular zone on retinal angiograms using Markov random fields. Digital Signal Processing. 20(1): p. 149-154.
[5]. McAfee Avert Labs, “French Authorities Talk Up Digital Investigations,” http://process-info.org/news/ security-news-blogs/archive/2010/10/french-authorities-talk-up-digital-investigations, October 2010, [Online; Status: March 29th 2011].
[6]. C. Veenman, “Statistical Disk Cluster Classification for File Carving” Intelligent System Lab, Computer Science Institute, University of Amsterdam, Amsterdam,Digital Technology and Biometrics Department, Netherlands Forensic Institute, The Hagu, Conference Paper · August 2007.
[7]. A. Pal and N. D. Memon, “The evolution of file carving,” IEEE Signal Processing Magazine, vol. 26, no. 2, pp. 59–71, March 2009.
[8]. ] S. Kloet, “Master’s Thesis Measuring and Improving the Quality of File Carving Methods” Supervisor: Prof. Dr. W.J. Fokkink, Eindhoven University of Technology Department of Mathematics and Computer ScienceAlmere, October 29, 2007.
[9]. Daniel B. Garrie and J. David Morrissy, “Digital Forensic Evidence in the Courtroom: Understanding Content and Quality” 12 Nw.J. Tech. & Intell.Prop.121,https://scholarlycommons.law.northwestern.edu/njtip/vol12/iss2/5N orthwestern Journal of Technology and Intellectual Property, Spring 2014.
[10]. J. Ashcroft, Deborah J. Daniels and Sarah V. Hart, “Forensic Examination of Digital Evidence: A Guide for Law Enforcement” U.S. Department of Justice Office of Justice Programs 810 Seventh Street N.W. Washington, DC 20531, http://www.ojp.usdoj.gov/nij
[11]. R. Pahade, B. Singh and U. Singh, “A SURVEY ON MULTIMEDIA FILE CARVING”. Department of Computer Science & Engineering, Defense Institute of Advanced Technology (DIAT), Pune, India Xiaohong, G., et al. A method of vessel tracking for vessel diameter measurement on retinal images. in Image Processing, 2001. Proceedings. 2001 International Conference on.
[12]. N. Škrbina and T. Stojanovski, “USING PARALLEL PROCESSING FOR FILE CARVING” European UniversitySkopje, Republic of Macedonia,2013.
[13]. L. Pereira and C. Romano, “File carving in practice” (Master Computing Engineering Dissertation supervised by Prof. Cunha) October2015.Pinz, A., et al., Mapping the human retina. Medical Imaging, IEEE Transactions on, 1998. 17(4): p. 606-619.
[14]. A. Pal and N. Memon, “The Evolution of File Carving [The benefits and problems of forensics recovery]” IEEE SIGNAL PROCESSING MAGAZINE MARCH 2009.
