Professional Documents
Culture Documents
www.ForensicInnovations.com
The sectors containing the files are orphaned Some of them may get overwritten They are like many jigsaw puzzles thrown into a trash bag, if they were fragmented. If some sectors were stored consecutively, then its like puzzle pieces that werent pulled apart before getting trashed.
http://www.forensicswiki.org/wiki/File_Carving
Statistical Carving
Use statistics or content characteristics to identify each sector. Entropy measurement Filter out blocks that clearly arent part of a desired file type.
Header/Footer Carving
Search for file header signature(s). Search for the matching file footer signatures. Capture the sectors in between.
Semantic Carving
Identify the language used in a sector. Identify the language used in each of the following sectors Collect the sectors that are written in the same language
Repackaging Carving
Used on partially recovered files. Rebuild the parts of the file that were not able to be recovered. The result should be a file that can be opened with its native application or a standard viewer.
SmartCarving
Use knowledge of the file systems typical fragmentation effects. Preprocess the source sectors.
Decompress, decrypt or translate the data
Hash Carving
Calculate a hash value for each sector
MD5, SHA-1
DataLifter
header-footer carving; Supports 25 file types
Encase
header-footer carving; Supports ~250 file types
Foremost
file structure based carving for avi, bmp, doc, gif, hmlt, jpg, mov, pdf, png, rar, wav and zip files. header-footer carving for art, asf, chm, cookie, cpp, dat, dbx, fws, idx, java, lnk, mail, mbx, mp3, mpg, ost, pgd, pgp, ppt, pst, ra, rdp, rpm, tif, txt, wma, wmv, wpc and xls files.
http://www.forensicswiki.org/w/images/b/b9/Kloet_2007.pdf
NFI Defraser
Fragment recovery carving & carving with validation; Supports MPEG, 3GPP, Quicktime & AVI files
PhotoRec
combination of file structure based carving and header-footer carving of 80 file formats
PyFlag
appears to use a simple text search method, ignoring sector boundaries; Supports server log file formats
Recover My Files
internal techniques unknown; Supports 200 file types
Revit
SmartCarving; Supported file types list not available
http://www.forensicswiki.org/w/images/b/b9/Kloet_2007.pdf
X-Ways
header-footer carving; unknown support list
http://www.forensicswiki.org/wiki/Tools:Data_Recovery#Carving
Tool Problems
Few tools handle file fragmentation The tools that handle fragmentation support very few file types Most tools can not detect false positives Most tools hard code file type support Only 1 tool claims to rebuild partial files
It only supports 5 file types (image files)
Performance is a problem
most tools utilize inefficient databases and scripting languages
Future Tools
Carver 2.0
Open Source, in the early specification stages
File Harvester
Combination of multiple methods:
Block Based Carving Statistical Carving Header/Footer Carving Header/Embedded Length Carving File Structure Based Carving Fragment Recovery Carving Repackaging Carving (Phase 3) SmartCarving Fuzzy Hash Carving (secret sauce)
Thank you
Contact
Rob Zirnstein Rob.Zirnstein@ForensicInnovations.com www.ForensicInnovations.com (317) 430-6891