TY - JOUR
T1 - A study on multimedia file carving method
AU - Yoo, Byeongyeong
AU - Park, Jungheum
AU - Lim, Sungsu
AU - Bang, Jewan
AU - Lee, Sangjin
N1 - Funding Information:
Acknowledgment This work was supported by the IT R&D program of MKE/KEIT[10035157, Development of Digital Forensic Technologies for Real-Time Analysis].
Copyright:
Copyright 2012 Elsevier B.V., All rights reserved.
PY - 2012/11
Y1 - 2012/11
N2 - File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.
AB - File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.
KW - File carving
KW - Multimedia file
KW - NTFS compressed file
UR - http://www.scopus.com/inward/record.url?scp=84864029668&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84864029668&partnerID=8YFLogxK
U2 - 10.1007/s11042-010-0704-y
DO - 10.1007/s11042-010-0704-y
M3 - Article
AN - SCOPUS:84864029668
SN - 1380-7501
VL - 61
SP - 243
EP - 261
JO - Multimedia Tools and Applications
JF - Multimedia Tools and Applications
IS - 1
ER -