A Tool for Recovery of Deleted Contiguous Files from Storage Media : Limitations and Guidelines for Solutions
Keywords:
Contiguous Files, Digital Forensics, File Carving, Crime Evidence, Suspected Storage MediaAbstract
Digital forensic labs across the globe looking for next generation software tool for extracting evidence from suspected storage media. The current tools cannot extract the existing evidence when the deleted files are fragmented. Also, they cannot extract evidence from partially existing set of blocks of deleted files. In the past two decades enormous research across the globe has taken place to address these challenging problems. Now it is time to focus on concentrating on translational research to build a next generation evidence extraction tool for use in digital forensic labs. In this paper, we propose an initial version of the next generation evidence extraction tool named as “ByteSequenceToEvidence 1.0”. This paper contributes (a) Recovery of deleted contiguous files (b) Limitations of the current version and guidelines for incorporating the available research outcomes in future versions. In this paper, we also present the fundamentals of file carving that researchers developing evidence extraction tools should understand.
Downloads
References
N. Memon and A. Pal, "Automated reassembly of file fragmented images using greedy algorithms," in IEEE Transactions on Image Processing, vol. 15, no. 2, pp. 385-393, Feb. 2006, doi: 10.1109/TIP.2005.863054.
Van der Meer, V.; van den Bos, J.; Jonker, H.; Dassen, L. Problem solved: A reliable, deterministic method for JPEG fragmentation point detection. Forensic Sci. Int. Digit. Investig. 2024, 48, 301687.
Zha, X., Sahni, S. (2011). Fast in-Place File Carving for Digi]tal Forensics. In: Lai, X., Gu, D., Jin, B., Wang, Y., Li, H. (eds) Forensics in Telecommunications, Information, and Multimedia. e-Forensics 2010. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 56. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-23602-0_13.
Pal A, Memon N (2009) The evolution of file carving: the benefits and problems of forensics recovery. IEEE Signal Processing Magazine 26(2)
Microsoft Corporation, *Microsoft MS-DOS User’s Guide and Reference*, MS-DOS Version 6.22, Redmond, WA, USA, 1994.
Poisel R, Tjoa S (2013) A comprehensive literature review of file carving. In: International conference on availability, reliability and security.
Tang Y, Fang J, Chow KP, Yiu SM, Xu J, Feng B, Li Q, Han Q (2016) Recovery of heavily fragmented JPEG files, Elsevier, Digital Investigation.
Gonçalves P., Dološ K., Stebner M., Attenberger A,Baier H. Revisiting the dataset gap problem – on availability, assessment and perspective of mobile forensic corporaFor. Sci. Int.: digit. Invest., 43 (2022),Article 301439, 10.1016/j.fsidi.2022.301439
Srinivas K, Venugopal T (2017) Automated generation of a natural challenge file for file carving algorithms. In: International conference on applied sciences, engineering, technology and management-2017 at DRK Institute of Science and Technology, Hyderabad, Telangana, India
Srinivas K, Venugopal T (2020) Testing a file carving tool using realistic datasets generated with openness. Int J Data Anal Techniques Strategies.
H. Sencar and N. Memon, Identification and recovery of JPEG files with missing fragments, Digital Investigation, vol. 6(S), pp. S88–S98, 2009.
Downloads
Published
Issue
Section
License
Copyright (c) 2025 International Journal of Scientific Research in Computer Science, Engineering and Information Technology
This work is licensed under a Creative Commons Attribution 4.0 International License.
