In 2014, we launched our open-access repository which offers full text access to conference proceedings from many of our events including the INC and HAISA series. These papers are free to access and distribute (subject to citing the source).
South African Information Security Multi-Conference (SAISMC 2010)
Title: Optimal Path Construction for Fragmented File Carving
Author(s): Hwei-Ming Ying, Vrizlynn LL Thing
Keywords: Fragmented data carving
Abstract: Fragmented File carving is an important technique in Digital Forensics to recover files from
their fragments in the absence of the file system allocation information. In this paper, the
fragmented file carving problem is formulated as a graph theoretic problem. Using this model,
we describe two algorithms, “Optimal Carve” and “Probabilistic-based Carve”, to perform file
reconstruction and recovery. Optimal Carve is a deterministic technique to recover the best file
construction path. We show that this technique is more efficient and accurate than existing
brute force techniques. The Probabilistic-based Carve technique involves a trade-off between
the final score of the constructed path of the file and the file recovery time to allow a faster
recovery process for highly fragmented files.
Download count: 985
How to get this paper:
PDF copy of this paper is free to download. You may distribute this copy providing you cite this page as the source.