Open access repository

Home Open access repository

In 2014, we launched our open-access repository which offers full text access to conference proceedings from many of our events including the INC and HAISA series. These papers are free to access and distribute (subject to citing the source).

» Openaccess proceedings » South African Information Security Multi-Conference (SAISMC 2010)

South African Information Security Multi-Conference (SAISMC 2010)

South African Information Security Multi-Conference (SAISMC 2010)
Port Elizabeth, South Africa, May 17-18, 2010
ISBN: 978-1-84102-256-7

Title: Optimal Path Construction for Fragmented File Carving
Author(s): Hwei-Ming Ying, Vrizlynn LL Thing
Reference: pp248-260
Keywords: Fragmented data carving
Abstract: Fragmented File carving is an important technique in Digital Forensics to recover files from
their fragments in the absence of the file system allocation information. In this paper, the
fragmented file carving problem is formulated as a graph theoretic problem. Using this model,
we describe two algorithms, “Optimal Carve” and “Probabilistic-based Carve”, to perform file
reconstruction and recovery. Optimal Carve is a deterministic technique to recover the best file
construction path. We show that this technique is more efficient and accurate than existing
brute force techniques. The Probabilistic-based Carve technique involves a trade-off between
the final score of the constructed path of the file and the file recovery time to allow a faster
recovery process for highly fragmented files.
Download count: 1542

How to get this paper:

Download a free PDF copy of this paperBuy this book at Lulu.com

PDF copy of this paper is free to download. You may distribute this copy providing you cite this page as the source.