Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

A Strategy for Testing Graphic File Carving Tools

Published

Author(s)

James R. Lyle, Richard P. Ayers

Abstract

File carving is widely used in digital investigations to extract deleted files from unallocated storage. Usually file carving is applied to file types with a recognizable structure so that unallocated space can be scanned for file components that are then reassembled into complete files. If the file has easily identified beginning and ending content and is contiguously allocated then carving is simple. However, the reality of file fragmentation complicates the task considerably. A common tool testing strategy is needed to help investigators characterize and understand tool behaviors, to compare tools, and to create test data with known content for investigator practice and training.

Keywords

Digital, Software, Testing

Citation

Lyle, J. and Ayers, R. (2014), A Strategy for Testing Graphic File Carving Tools (Accessed December 11, 2024)

Issues

If you have any questions about this publication or are having problems accessing it, please contact reflib@nist.gov.

Created February 19, 2014, Updated September 18, 2018