Skip to main content
SpringerLink
Log in

File Carving

  • Chapter
  • First Online:
Introductory Computer Forensics

Abstract

The objectives of this chapter are to:

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Hardcover Book
USD 119.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. BMP file format. https://en.wikipedia.org/wiki/BMP_file_format

  2. A. Pal and N. Memon. The evolution of file carving. IEEE Signal Processing Magazine, vol. 26, no. 2, pp. 59-71, March 2009

    Google Scholar 

  3. Z. Lei. Forensic analysis of unallocated space. Master’s Thesis, University of Ontario Institute of Technology, 2011

    Google Scholar 

  4. C. Beek. Introduction to File Carving. McAfee White Paper. Available at: http://www.mcafee.com/ca/resources/white-papers/foundstone/wp-intro-to-file-carving.pdf

  5. Guidance Software. Investigations of individuals. Available: http://www.guidancesoftware.com/computer-forensics-ediscovery-individual-investigation.htm

  6. X. Lin, C. Zhang, T. Dule. On Achieving Encrypted File Recovery. In: X. Lai, D. Gu, B. Jin, Y. Wang, H. Li (eds) Forensics in Telecommunications, Information, and Multimedia. e-Forensics 2010. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 56. Springer, Berlin, Heidelberg

    Google Scholar 

  7. File carving - forensics wiki. Available: http://www.forensicswiki.org/wiki/File_Carving

  8. Digital Forensics Research Workshop 2005. http://old.dfrws.org/2005/index.shtml

  9. S. L. Garfinkel. Carving contiguous and fragmented files with fast object validation. Digital Investigation, vol. 4, pp. 2-12, 2007

    Article  Google Scholar 

  10. A. Pal, H. T. Sencar and N. Memon. Detecting file fragmentation point using sequential hypothesis testing. Digital Investigation, vol. 5, pp. S2-S13, 2008

    Article  Google Scholar 

  11. G. Richard and V. Roussev. Scalpel: A Frugal, High Performance File Carver. DFRWS 2005 USA

    Google Scholar 

  12. Y. Wei, N. Zheng, and M. Xu. “An Automatic Carving Method for RAR File Based on Content and Structure”, Second International Conference on Information Technology and Computer Science, 2010, pp. 68-72

    Google Scholar 

  13. M. Chen, N. Zheng, X. Xu, Y.J. Lou, and X. Wang. “Validation Algorithms Based on Content Characters and Internal Structure: The PDF File Carving Method”, International Symposium on Information Science and Engineering, Dec. 2008, vol. 1, pp. 168-172

    Google Scholar 

  14. Foremost (http://foremost.sourceforge.net/)

  15. Scalpel. https://github.com/sleuthkit/scalpel

  16. “TestDisk - Partition Recovery and File Undelete”, Cgsecurity.org, 2017. [Online]. Available: http://www.cgsecurity.org/wiki/TestDisk. [Accessed: 06- Apr- 2017]

  17. “PhotoRec - Digital Picture and File Recovery”, Cgsecurity.org, 2017. [Online]. Available: http://www.cgsecurity.org/wiki/PhotoRec#Operating_systems. [Accessed: 06- Apr- 2017]

  18. DFRWS 2006 Challenge: http://old.dfrws.org/2006/challenge/submission.shtml

  19. Digital Forensics Tool Testing Images. http://dftt.sourceforge.net/

Download references

Author information

Authors and Affiliations

  1. Department of Physics and Computer Science, Faculty of Science, Wilfrid Laurier University, Waterloo, ON, Canada

    Xiaodong Lin

Authors
  1. Xiaodong Lin
    View author publications

    You can also search for this author in PubMed Google Scholar

Rights and permissions

Reprints and permissions

Copyright information

© 2018 Springer Nature Switzerland AG

About this chapter

Check for updates. Verify currency and authenticity via CrossMark

Cite this chapter

Lin, X. (2018). File Carving. In: Introductory Computer Forensics. Springer, Cham. https://doi.org/10.1007/978-3-030-00581-8_9

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-00581-8_9

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-00580-1

  • Online ISBN: 978-3-030-00581-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation