Hanseong Lee, Hyung-WooLee, Journal of Internet Computing and Services, Vol. 21, No. 3, pp. 93-102, Jun. 2020
10.7472/jksii.2020.21.3.93, Full Text:
Keywords: File Carving, Smart Carving, File System, Block, Fragmentation, Forgery Analysis, Digital Forensics.

Abstract

In order for data obtained through all stages of digital crime investigation to be recognized as evidence capability, it must satisfy legal / technical requirements. In this paper, we propose a mechanism and implement software to provide digital forensic evidence by automatically recovering files by scanning / inspecting the unallocated area inside the storage disk block without relying on information provided by the file system. The proposed technique checks / analyzes the RAW disk data of the system under analysis in 512-byte block units based on information on the storage format / file structure of various files stored on the disk without referring to the file system-related information provided by the operating system. The file carving process was implemented, and a smart carving mechanism was proposed to intelligently restore deleted or damaged files in the storage device. As a result, we have provided a block based smart carving method to intelligently identify fragmented and damaged files in storage efficiently for forgery analysis on digital forensic investigation.

Statistics
Cite this article