Advanced carving techniques

“Carving” is the term most often used to indicate the act of recovering a file from unstructured digital forensic  images. The term unstructured  indicates that the original digital image does not contain useful filesystem  information which may be used to assist in this recovery. Typically, forensic analysts resort to carving techniques as an avenue of last resort due to the difficulty of current  techniques. Most current techniques rely on manual inspection of the file to be recovered, and manually  reconstructing this file using trial and error. Manual processing is typically impractical for modern disk images  which might contain hundreds of thousands of files. At the same time the traditional process of recovering deleted files using filesystem information is becoming less  practical because most modern file systems purge critical information for de...

• Type: Journal
• Year: 2007
• Where: DI
• Authors: M. I. Cohen
• Keywords: DI 2007, Images. The term unstructured indicates that the original digital image does not contain useful filesystem Information which may be used to assist in this recovery, Practical because most modern file systems purge critical information for deleted files. As such the need for Automated carving techniques is quickly arising even when a filesystem does exist on the forensic image