A study on multimedia file carving method

Byeongyeong Yoo, Jungheum Park, Sungsu Lim, Jewan Bang, Sangjin Lee

Research output: Contribution to journalArticle

12 Citations (Scopus)

Abstract

File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.

Original languageEnglish
Pages (from-to)243-261
Number of pages19
JournalMultimedia Tools and Applications
Volume61
Issue number1
DOIs
Publication statusPublished - 2012 Nov 1

Fingerprint

Recovery
Data compression
Digital forensics

Keywords

  • File carving
  • Multimedia file
  • NTFS compressed file

ASJC Scopus subject areas

  • Media Technology
  • Hardware and Architecture
  • Computer Networks and Communications
  • Software

Cite this

A study on multimedia file carving method. / Yoo, Byeongyeong; Park, Jungheum; Lim, Sungsu; Bang, Jewan; Lee, Sangjin.

In: Multimedia Tools and Applications, Vol. 61, No. 1, 01.11.2012, p. 243-261.

Research output: Contribution to journalArticle

Yoo, Byeongyeong ; Park, Jungheum ; Lim, Sungsu ; Bang, Jewan ; Lee, Sangjin. / A study on multimedia file carving method. In: Multimedia Tools and Applications. 2012 ; Vol. 61, No. 1. pp. 243-261.
@article{380583af64c64cf6b23f7c9d5ee8cf54,
title = "A study on multimedia file carving method",
abstract = "File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.",
keywords = "File carving, Multimedia file, NTFS compressed file",
author = "Byeongyeong Yoo and Jungheum Park and Sungsu Lim and Jewan Bang and Sangjin Lee",
year = "2012",
month = "11",
day = "1",
doi = "10.1007/s11042-010-0704-y",
language = "English",
volume = "61",
pages = "243--261",
journal = "Multimedia Tools and Applications",
issn = "1380-7501",
publisher = "Springer Netherlands",
number = "1",

}

TY - JOUR

T1 - A study on multimedia file carving method

AU - Yoo, Byeongyeong

AU - Park, Jungheum

AU - Lim, Sungsu

AU - Bang, Jewan

AU - Lee, Sangjin

PY - 2012/11/1

Y1 - 2012/11/1

N2 - File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.

AB - File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.

KW - File carving

KW - Multimedia file

KW - NTFS compressed file

UR - http://www.scopus.com/inward/record.url?scp=84864029668&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84864029668&partnerID=8YFLogxK

U2 - 10.1007/s11042-010-0704-y

DO - 10.1007/s11042-010-0704-y

M3 - Article

VL - 61

SP - 243

EP - 261

JO - Multimedia Tools and Applications

JF - Multimedia Tools and Applications

SN - 1380-7501

IS - 1

ER -