We found a match
Your institution may have access to this item. Find your institution then sign in to continue.
- Title
A study on multimedia file carving method.
- Authors
Yoo, Byeongyeong; Park, Jungheum; Lim, Sungsu; Bang, Jewan; Lee, Sangjin
- Abstract
File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.
- Subjects
COMPUTER files; ELECTRONIC file management; FILES (Records); DATABASE management; ELECTRONIC information resources; FORENSIC sciences; DATA compression
- Publication
Multimedia Tools & Applications, 2012, Vol 61, Issue 1, p243
- ISSN
1380-7501
- Publication type
Article
- DOI
10.1007/s11042-010-0704-y