Published: February 19, 2014
James R. Lyle, Richard P. Ayers
File carving is widely used in digital investigations to extract deleted files from unallocated storage. Usually file carving is applied to file types with a recognizable structure so that unallocated space can be scanned for file components that are then reassembled into complete files. If the file has easily identified beginning and ending content and is contiguously allocated then carving is simple. However, the reality of file fragmentation complicates the task considerably. A common tool testing strategy is needed to help investigators characterize and understand tool behaviors, to compare tools, and to create test data with known content for investigator practice and training.
Pub Type: Talks
Digital, Software, Testing
Created February 19, 2014, Updated September 18, 2018