Author : K. Srinivas 1
Date of Publication :14th November 2017
Abstract: File Carving is a technique of reassembling unordered mixed file fragments, without using files’ metadata such as FAT, for reconstructing the actual files present on the disk. In the areas of data recovery and digital forensics this situation arises. A challenge file consists of number of files, in the form of fragments, mixed in random order. In this paper authors have presented a software system that generates a challenge file by implementing, at user level, a file system which broadly follows FAT file system. This software system uses a large size file to store file fragments just like a kernel level file system uses disk to store files. The kernel level file system fragments the file, as per the availability of free clusters, at the time of creation of the file. By viewing the challenge file as a virtual disk, it consists of the number of virtual clusters. The software system presented in this paper, a user level file system, fragments the file, as per the availability of free clusters, on the virtual disk i.e., the challenge file. This challenge file consists of mixed file fragments of number of user files. The content of the challenge file is a result of software module which broadly follows FAT file system. The challenge file thus generated is, therefore a natural challenge file. This challenge file provides the writers of file carving algorithms a platform to test their algorithms. The designers of file carvers can use the challenge file conveniently as a virtual disk, in place of the actual disk, thus eliminating the need of physical hard disk for testing their algorithms. There are number of other benefits of this approach as outlined in this paper
Reference :
-
- Nasir Memon, Anandabrata Pal, “Automated Reassembly of File Fragmented Images Using Greedy Algorithms”, IEEE Transactions on Image Processing, Volume 15, No.2, February, 2006
- Maurice J Bach Pearson, “The Design of the Unix Operating System” (Pearson)
- Peter Abel, “IBM PC Assembly Language and Programming”, Third Edition – PHI..
- Kulesh Shanmugasundaram, Nasir Memon, Automatic Reassembly of Document Fragments via Context Based Statistical Models, Department of Computer and Information Science Polytechnic University Brooklyn.