File Carving.pdf

(1547 KB) Pobierz
Forensics II
File carving
What is file carving and why do it?
Simple file carving
The file carving process
File carving software
Advanced file carving
File carving fundamentals
• File Carving definition
–
Carving is a general term for extracting structured data
(files) out of raw data, based on format specific
characteristics present in the structured data
• File carving is a powerful technique because it can
–
Identify and recover files of interest from raw, deleted or
damaged file systems, memory, or swap space data
–
Assist in recovering files and data that may not be
accounted for by the operating system and file system
•
File metadata is no longer available
–
Assist in simple data recovery
•
http://www.forensicswiki.org/wiki/Tools:Data_Recovery
File carving details 1
• Identify and recover files based on analysis of file formats
• Header-footer or header-maximum file size carving
–
Many file types have well-known values or magic numbers in the
first bytes of the file header and in the last bytes of the file
– Identify specific types of file headers and/or footers and carve
out blocks between these two boundaries
– Stop carving after a user-specified or set limit has been reached
–
Unfortunately not all file types have a standard footer signature
so determining the EOF can be difficult – thus the need for limits
• File structure based carving (metadata in the file as well)
• Content based carving (semantics etc.)
File Structure and Content-based
Based Carving
• File Structure Based Carving
–
This technique uses the internal layout of a file
–
Elements are header, footer, identifier strings and size information etc.
–
Known carvers which use this technique are Scalpel and PhotoRec
• Content-based Carving
–
Content structure
•
Loose structure (MBOX, HTML, XML)
–
Content characteristics
•
•
•
•
•
Character count
Text/Language recognition
White and Black listing of data (filter)
Statistical attributes
Information entropy
File carving details 2
• Many carving programs have an option to only look at or near
sector or cluster boundaries where headers are found
–
File start is always at a sector boundary, but end is not
• However, searching the entire input can find files that have
been embedded into other files, such as JPEGs being
embedded into OLE documents etc.
– This may be considered an advantage or a disadvantage,
depending on the circumstances
• The majority of file carving programs will only recover files that
are contiguous on the media (in other words: files that are not
fragmented)
• Files may be incomplete
– Start, end, middle sectors may have been reused

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin