Performance Analysis of File Carving Tools

Abstract : File carving is the process of recovering files based on the contents of a file in scenarios where file system metadata is unavailable. In this research a total of 6 file carving tools were tested and reviewed to evaluate the performance quality of each. Comparison of findings to a previous similar study was conducted and showed variable performance advances. A new file carving data set was also authored and testing determined that the wider variety of file types and structures proved challenging for most tools to efficiently recover a high percentage of files. Results also highlighted the ongoing issue with complete recovery and reassembly of fragmented files. Future research is required to provide digital forensic investigators & data recovery practitioners with efficient and accurate file carving tools to maximise file recovery and minimise invalid file output.
Document type :
Conference papers
Complete list of metadatas

Cited literature [19 references]  Display  Hide  Download

https://hal.inria.fr/hal-01463843
Contributor : Hal Ifip <>
Submitted on : Thursday, February 9, 2017 - 5:24:23 PM
Last modification on : Wednesday, October 17, 2018 - 8:10:03 PM
Long-term archiving on: Wednesday, May 10, 2017 - 2:50:08 PM

File

978-3-642-39218-4_31_Chapter.p...
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Thomas Laurenson. Performance Analysis of File Carving Tools. 28th Security and Privacy Protection in Information Processing Systems (SEC), Jul 2013, Auckland, New Zealand. pp.419-433, ⟨10.1007/978-3-642-39218-4_31⟩. ⟨hal-01463843⟩

Share

Metrics

Record views

189

Files downloads

1766