Resurrecting Portable Network Graphics using block generators
Martin Lambertz, Jan-Niclas Hilgert, Roman Schell · Digital Investigation · 2018
The recovery of deleted data is an important, recurring task during a digital forensic investigation.One approach to recover file is to make use of file system metadata.This is not possible when the file system is corrupted, not trusted, unknown or not supported by analysis tools.In these cases, an investigator can resort to file carving where data is recovered without using a file system.