The week's pick
Reseach Article
Unconventional Method of Accessing Files – An Automated Generation of its Input
| Communications on Applied Electronics |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 7 - Number 9 |
| Year of Publication: 2017 |
| Authors: K. Srinivas, T. Venugopal |
10.5120/cae2017652714
|
K. Srinivas, T. Venugopal . Unconventional Method of Accessing Files – An Automated Generation of its Input. Communications on Applied Electronics. 7, 9 ( Nov 2017), 19-26. DOI=10.5120/cae2017652714
Abstract
File Carving is an unconventional method of accessing files from disk. It is a technique of reassembling unordered mixed file fragments, without using files’ metadata such as FAT, for reconstructing the actual files present on the disk. In the areas of data recovery and digital forensics this situation arises. A challenge file is an input file for testing a file carving tool during its development phase and it consists of a number of files, in the form of fragments, mixed in random order [1]. In this paper authors have presented a software system that generates a challenge file by implementing, at user level, a file system which broadly follows FAT file system. This software system uses a large size file to store file fragments just like a kernel level file system uses disk to store files. The designers of file carvers can use the challenge file conveniently as a virtual disk, in place of the actual disk, thus eliminating the need of a physical hard disk for testing their algorithms. The kernel level file system fragments the file, as per availability of free clusters, at the time of creation or modification of files. The user level file system, fragments the file, as per availability of free clusters, on the virtual disk i.e., the challenge file. This challenge file consists of mixed file fragments of a number of user files. There are a number of other benefits of this approach as outlined in this paper.
References
- https://www.dfrws.org
- Andreas Dewald, Sabine Seufert, “AFEIC: Advanced forensic Ext4 inode carving”,DFRWS 2017 Europe – Proceedings of the 4th Annual DFRWS Europe – Elsevier Journal - Digital Investigation 20 (2017) S83-S91
- Nasir Memon, Anandabrata Pal, “Automated Reassembly of File Fragmented Images Using GreedyAlgorithms”,IEEE Transactions onImage Processing, Volume 15,No.2, February,2006
- Anadabrata Pal, Nasir Memon, “The Evolution of File Carving: The benefits and problems of forensics recovery”,IEEE Signal Processing magazine Vol. 26. No 2. March 2009.
- Simson L. Garfinkel: Carving contiguous and fragmented files with fast object validation, ELSEVIER, Digital Investigation, 2007.
- Nadeem Alherbawi, Zarina Shukur and Rossilawati Sulaiman, “A Survey on Data Carving in Digital Forensics”,ISSN: 1682-3915 - Asian Journal of Information Technology 15 (24): 5137-5144, 2016.
- K. Srinivas, T. Venugopal: Design and Implementation of File Carving Algorithms in Computer Forensics , National Conference on Advances in Computing and Networking, Computer Society of India - JNTUH College of Engineering, Manthani, Karimnagar p81-87, December 2014.
- Kulesh Shanmugasundaram, Nasir Memon: Automatic Reassembly of Document Fragments via Context Based Statistical Models, ACSAC '03 Proceedings of the 19th Annual Computer Security Applications Conference, IEEE Computer Society Washington, DC, USA.
- Xinyan Zha and Sartaj Sahni: Fast in-place file carving for digital forensics, Springer Link, 2011.
Index Terms
Keywords