Forensic analysis of deduplicated file systems


Deduplication splits files into fragments, which are stored in a chunk repository. Deduplication stores chunks that are common to multiple files only once. From a forensics point of view, a deduplicated device is very difficult to recover and it requires a specific knowledge of how this technology operates. Deduplication starts from a whole file, and… (More)


16 Figures and Tables

Cite this paper

@inproceedings{Lanterna2017ForensicAO, title={Forensic analysis of deduplicated file systems}, author={Dario Lanterna and Antonio Barili}, year={2017} }