Performance Analysis of File Carving Tools - Security and Privacy Protection in Information Processing Systems Access content directly
Conference Papers Year : 2013

Performance Analysis of File Carving Tools

Abstract

File carving is the process of recovering files based on the contents of a file in scenarios where file system metadata is unavailable. In this research a total of 6 file carving tools were tested and reviewed to evaluate the performance quality of each. Comparison of findings to a previous similar study was conducted and showed variable performance advances. A new file carving data set was also authored and testing determined that the wider variety of file types and structures proved challenging for most tools to efficiently recover a high percentage of files. Results also highlighted the ongoing issue with complete recovery and reassembly of fragmented files. Future research is required to provide digital forensic investigators & data recovery practitioners with efficient and accurate file carving tools to maximise file recovery and minimise invalid file output.
Fichier principal
Vignette du fichier
978-3-642-39218-4_31_Chapter.pdf (388.75 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01463843 , version 1 (09-02-2017)

Licence

Attribution

Identifiers

Cite

Thomas Laurenson. Performance Analysis of File Carving Tools. 28th Security and Privacy Protection in Information Processing Systems (SEC), Jul 2013, Auckland, New Zealand. pp.419-433, ⟨10.1007/978-3-642-39218-4_31⟩. ⟨hal-01463843⟩
223 View
3294 Download

Altmetric

Share

Gmail Facebook X LinkedIn More