Study on a carving method for deleted NTFS compressed files

Byeongyeong Yoo, Jungheum Park, Jewan Bang, Sangjin Lee

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. NTFS supports a compression function for internal files itself. However, the NTFS compression function has not been considered in the file carving. Thus, most of file carving tools cannot recover NTFS compressed files. This study describes the limitation in the existing file carving tools for the NTFS compressed files and proposes a recovering method for deleted NTFS compressed files.

Original languageEnglish
Title of host publication2010 3rd International Conference on Human-Centric Computing, HumanCom 2010
DOIs
Publication statusPublished - 2010
Event2010 3rd International Conference on Human-Centric Computing, HumanCom 2010 - Cebu, Philippines
Duration: 2010 Aug 112010 Aug 13

Publication series

Name2010 3rd International Conference on Human-Centric Computing, HumanCom 2010

Other

Other2010 3rd International Conference on Human-Centric Computing, HumanCom 2010
CountryPhilippines
CityCebu
Period10/8/1110/8/13

Keywords

  • Digital forensic
  • File carving
  • NTFS compressed files

ASJC Scopus subject areas

  • Computational Theory and Mathematics
  • Human-Computer Interaction
  • Software

Fingerprint Dive into the research topics of 'Study on a carving method for deleted NTFS compressed files'. Together they form a unique fingerprint.

Cite this