Advanced Multimedia File Carving
Martin Steinebach, York Yannikos, Sascha Zmudzinski, Christian Winter · 2015
This chapter discusses the state of the art in multimedia file carving. Combining common file carving approaches with content identification results in advanced multimedia file carving. In this context, ‘advanced’ means that the file carving strategy offers more assistance than the sole collection of evidence data. First, the chapter presents a brief introduction of storage technology aspects relevant for file carving, for example storage devices and file systems. File carving is a general method to enable accessing data lost to the file system. The chapter introduces the more general binary data file carving, and explains file carving designed specifically for multimedia. File carving describes the process of extracting file fragments from a byte stream such as a disk or volume image without file system information. This technique is used to recover data from unallocated space on hard disk storage. The chapter explains consequences of multimedia file characteristics for file carving.