In-Place File Carving

@inproceedings{Richard2007InPlaceFC,
  title={In-Place File Carving},
  author={G. Richard and V. Roussev and Lodovico Marziale},
  booktitle={IFIP Int. Conf. Digital Forensics},
  year={2007}
}
  • G. Richard, V. Roussev, Lodovico Marziale
  • Published in
    IFIP Int. Conf. Digital…
    2007
  • Computer Science
  • File carving is the process of recovering files from an investigative target, potentially without knowledge of the filesystem structure. Current generation file carvers make complete copies of recovered files. Unfortunately, they often produce a large number of false positives — “junk” files with invalid formats that frequently consume large amounts of disk space. 

    Figures, Tables, and Topics from this paper.

    Performance Analysis of File Carving Tools
    • 17
    • PDF
    Fast in-Place File Carving for Digital Forensics
    • 15
    • Highly Influenced
    • PDF
    Decision-theoretic file carving
    • 11
    File Reconstruction in Digital Forensic
    • 2
    • PDF
    A Comprehensive Literature Review of File Carving
    • 20

    References

    Publications referenced by this paper.
    SHOWING 1-10 OF 15 REFERENCES
    Scalpel: A Frugal, High Performance File Carver
    • 174
    • PDF
    Swapping to Remote Memory over InfiniBand: An Approach using a High Performance Network Block Device
    • 94
    • PDF
    dRamDisk: efficient RAM sharing on a commodity cluster
    • 18
    • PDF
    Bluepipe: An architecture for on-the-spot digital forensics
    • 2004
    Digital Forensics Research Workshop (DFRWS), File Carving Challenge – DFRWS 2006
      FUSE: Filesystem in Userspace (fuse.sourceforge .net)
        FUSE: Filesystem in Userspace (fuse.sourceforge .net)
          File Carving Challenge -DFRWS
          • 2006
          Network Block Device (nbd.sourceforge.net)