In-Place File Carving

  title={In-Place File Carving},
  author={Golden G. Richard and Vassil Roussev and Lodovico Marziale},
  booktitle={IFIP Int. Conf. Digital Forensics},
File carving is the process of recovering files from an investigative target, potentially without knowledge of the filesystem structure. Current generation file carvers make complete copies of recovered files. Unfortunately, they often produce a large number of false positives – “junk” files with invalid formats that frequently consume large amounts of disk… CONTINUE READING