Roadmap for Forensic Tool Development for Orphaned File Fragment Carving
Keywords:
Orphaned Fragments, Digital Forensics, File Carving, Crime Evidence, Suspected Storage MediaAbstract
Digital forensic experts encounter a sequence of raw bytes (a fragment of a file) in the absence of both the remaining fragments of the file and file system metadata. A tool must be developed to interpret these orphaned fragments and to reveal any evidence of crime, if such evidence exists. In this paper, we present a roadmap for developing such a challenging tool. The tool development requires a group of computer science researchers and software developers. This paper aims to provide guidance to the team responsible for developing this tool. Two major problems are addressed by authors of this paper in the direction of developing orphaned file fragment carver tool. They are (a) Development of a tool for creating an emulating storage media for use in research lab environment to mimic suspected storage media in forensic labs. (b) Development of an orphaned file fragment carver for an uncompressed image data type. In this paper, we will present the outcomes of these tools and roadmap on how to extend the tools for creating a tool of orphaned file fragment carver as an end product which can be used in digital forensic labs.
Downloads
References
Ahmed, I., Lhee, K., Hong, S., & Seo, J. (2010). On the analysis of file fragment classification. Digital Investigation, 7(1–2), 74–82.
Calhoun, W. C., & Coles, D. (2008). Predicting the types of file fragments. Digital Investigation, 5, S14–S20.
Garfinkel, S. (2007). Carving contiguous and fragmented files with fast object validation. Digital Investigation, 4, 2–12.
Garfinkel, S., Nelson, A., & Young, J. (2012). A general strategy for file carving evaluation. Digital Investigation, 9, S73–S81.
Moody, K. (2011). Automatic file fragment reassembly using greedy algorithms. Proceedings of the DFRWS.
Pal, A., Sencar, H. T., & Memon, N. (2003). Detecting file type mismatches for digital forensics. Proceedings of SPIE 5306.
Richard, G. G., & Roussev, V. (2005). Scalpel: A frugal, high performance file carver. DFRWS Annual Conference.
Roussev, V. (2009). Data fingerprinting with similarity digests. Proceedings of the DFRWS.
Sencar, H. T., & Memon, N. (2009). Overview of file fragmentation and reconstruction techniques. In N. Memon (Ed.), Digital Forensics Research.
Sai, A., Thompson, B., & Mislan, R. (2014). File fragment reassembly using pairwise similarity and optimization. Journal of Digital Forensics, Security and Law.
Srinivas, K., Baswaraj, D. (2024). Forensic Analysis of the Uncompressed Image Data Cluster for Estimating the Image Width. In: Gunjan, V.K., Kumar, A., Zurada, J.M., Singh, S.N. (eds) Computational Intelligence in Machine Learning. ICCIML 2022. Lecture Notes in Electrical Engineering, vol 1106. Springer, Singapore.
K. Srinivas, T. Venugopal “Testing a File Carving Tool Using Realistic Datasets Generated with Openness”, International Journal of Data Analysis Techniques and Strategies, 2020 Vol.12 No.2, pp.155 - 171.
Downloads
Published
Issue
Section
License
Copyright (c) 2025 International Journal of Scientific Research in Science and Technology
This work is licensed under a Creative Commons Attribution 4.0 International License.
https://creativecommons.org/licenses/by/4.0
