%0 Conference Proceedings
%T Performance Analysis of File Carving Tools
%+ University of Otago [Dunedin, Nouvelle-Zélande]
%A Laurenson, Thomas
%Z Part 9: Security Management/Forensic
%< avec comité de lecture
%( IFIP Advances in Information and Communication Technology
%B 28th Security and Privacy Protection in Information Processing Systems (SEC)
%C Auckland, New Zealand
%Y Lech J. Janczewski
%Y Henry B. Wolfe
%Y Sujeet Shenoi
%I Springer
%3 Security and Privacy Protection in Information Processing Systems
%V AICT-405
%P 419-433
%8 2013-07-08
%D 2013
%R 10.1007/978-3-642-39218-4_31
%K File Carving
%K Data Recovery
%K Digital Forensics
%Z Computer Science [cs]Conference papers
%X File carving is the process of recovering files based on the contents of a file in scenarios where file system metadata is unavailable. In this research a total of 6 file carving tools were tested and reviewed to evaluate the performance quality of each. Comparison of findings to a previous similar study was conducted and showed variable performance advances. A new file carving data set was also authored and testing determined that the wider variety of file types and structures proved challenging for most tools to efficiently recover a high percentage of files. Results also highlighted the ongoing issue with complete recovery and reassembly of fragmented files. Future research is required to provide digital forensic investigators & data recovery practitioners with efficient and accurate file carving tools to maximise file recovery and minimise invalid file output.
%G English
%Z TC 11
%2 https://inria.hal.science/hal-01463843/document
%2 https://inria.hal.science/hal-01463843/file/978-3-642-39218-4_31_Chapter.pdf
%L hal-01463843
%U https://inria.hal.science/hal-01463843
%~ IFIP
%~ IFIP-AICT
%~ IFIP-TC
%~ IFIP-TC11
%~ IFIP-SEC
%~ IFIP-AICT-405