In-Place File Carving

  title={In-Place File Carving},
  author={Golden G. Richard and Vassil Roussev and Lodovico Marziale},
  booktitle={IFIP Int. Conf. Digital Forensics},
File carving is the process of recovering files from an investigative target, potentially without knowledge of the filesystem structure. Current generation file carvers make complete copies of recovered files. Unfortunately, they often produce a large number of false positives – “junk” files with invalid formats that frequently consume large amounts of disk space. This paper describes an “in-place” approach to file carving, which allows the inspection of recovered files without copying file… CONTINUE READING
Highly Cited
This paper has 30 citations. REVIEW CITATIONS

From This Paper

Figures, tables, and topics from this paper.


Publications citing this paper.
Showing 1-10 of 13 extracted citations

Decision-theoretic file carving

Digital Investigation • 2017
View 2 Excerpts

A file undelete with Aho-Corasick algorithm in file recovery

2016 International Conference on Informatics and Computing (ICIC) • 2016
View 3 Excerpts

A survey on different video restoration techniques

2015 International Conference on Soft-Computing and Networks Security (ICSNS) • 2015
View 1 Excerpt

Frame-Based Recovery of Corrupted Video Files Using Video Codec Specifications

IEEE Transactions on Image Processing • 2014
View 1 Excerpt

A Comprehensive Literature Review of File Carving

2013 International Conference on Availability, Reliability and Security • 2013
View 1 Excerpt


Publications referenced by this paper.
Showing 1-4 of 4 references

dRamDisk: efficient RAM sharing on a commodity cluster

2006 IEEE International Performance Computing and Communications Conference • 2006
View 1 Excerpt

Scalpel: A frugal

G. Richard, V. Roussev
high performance file carver, Proceedings of the Fifth Annual Digital Forensics Research Workshop • 2005
View 2 Excerpts