Optimal Path Construction for Fragmented File Carving
Hwei-Ming Ying, Vrizlynn L. L. Thing · 2010
Fragmented File carving is an important technique in Digital Forensics to recover files from their fragments in the absence of the file system allocation information. In this paper, the fragmented file carving problem is formulated as a graph theoretic problem. Using this model, we describe two algorithms, “Optimal Carve” and “Probabilistic-based Carve”, to perform file reconstruction and recovery. Optimal Carve is a deterministic technique to recover the best file construction path. We show that this technique is more efficient and accurate than existing brute force techniques. The Probabilistic-based Carve technique involves a trade-off between the final score of the constructed path of the file and the file recovery time to allow a faster recovery process for highly fragmented files.