A study on multimedia file carving method

Byeongyeong Yoo, Jungheum Park, Sungsu Lim, Jewan Bang, Sangjin Lee

Research output: Contribution to journalArticle

13 Citations (Scopus)

Abstract

File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.

Original languageEnglish
Pages (from-to)243-261
Number of pages19
JournalMultimedia Tools and Applications
Volume61
Issue number1
DOIs
Publication statusPublished - 2012 Nov 1

Keywords

  • File carving
  • Multimedia file
  • NTFS compressed file

ASJC Scopus subject areas

  • Media Technology
  • Hardware and Architecture
  • Computer Networks and Communications
  • Software

Fingerprint Dive into the research topics of 'A study on multimedia file carving method'. Together they form a unique fingerprint.

  • Cite this