Skip to main content
Springer Nature Link
Log in

Survey of File Carving Techniques

  • Conference paper
  • First Online:
Innovative Systems for Intelligent Health Informatics (IRICT 2020)

Part of the book series: Lecture Notes on Data Engineering and Communications Technologies ((LNDECT,volume 72))

Abstract

File carving is a method that enables researchers to collect data from unallocated memory space. File carving is a technique used to retrieve data other than data recovery technique and data restoration technique. In general, carving is used to retrieve data with the absence of metadata that point to the content. There are various styles of file carving techniques used for types of files, including PDF, JPEG, XML and etc. [5]. This paper focuses mainly on the different types of carving techniques commonly used based on particular circumstances. The key contribution of this paper is the study and analysis of current existing file carving techniques for file carving in order to define their functionality. These techniques are also classified according to the carving method styles used and the fragmentation issues as well as the type of a file system since these techniques rely on the content and the file structure of the particular file to be carved. This paper is divided into two sections, the first section is the traditional carving approach and the second section is the advanced carving approach. This paper will be a guide for researchers searching for carving techniques in order to choose the appropriate carving algorithm and to continue improving it in the future.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

References

  1. Alghafli, K. et al.: Investigating and measuring capabilities of the forensics file carving techniques. In: Lecture Notes in Electrical Engineering. pp. 329–336 (2014). https://doi.org/10.1007/978-3-642-40861-8_47

  2. Alghafli, K., Martin, T.: Identification and recovery of video fragments for forensics file carving. 2016 11th Int. Conf. Internet Technol. Secur. Trans. ICITST 2016, 267–272 (2017) https://doi.org/https://doi.org/10.1109/ICITST.2016.7856710.

  3. Alherbawi, N., et al.: A survey on data carving in digital forensic. Asian J. Inf. Technol. 15(24), 5137–5144 (2016)

    Google Scholar 

  4. Alherbawi, N., et al.: Systematic Literature Review on Data Carving in Digital Forensic. Procedia Technol. 11, Iceei, 86–92 (2013). https://doi.org/10.1016/j.protcy.2013.12.165.

  5. Ali, R.R., et al.: A review of digital forensics methods for JPEG file carving. J. Theor. Appl. Inf. Technol. 96(17), 5841–5856 (2018)

    Google Scholar 

  6. Alshammary, E., Hadi, A.: Reviewing and evaluating existing file carving techniques for JPEG files. Proc. - 2016 Cybersecurity Cyberforensics Conf. CCC 2016. October 2017, pp. 55–59 (2016). https://doi.org/10.1109/CCC.2016.21.

  7. Collange, S., et al.: Using graphics processors for parallelizing hash-based data carving. In: Proceedings of 42nd Annual Hawaii International Conference System Science HICSS, pp. 1–10 (2009). https://doi.org/https://doi.org/10.1109/HICSS.2009.494.

  8. Darnowski, F., Chojnaki, A.: Selected methods of file carving and analysis of digital storage media in computer forensics. Teleinformatics Rev. 1(2), 25–40 (2015)

    Google Scholar 

  9. Garfinkel, S.L.: Carving contiguous and fragmented files with fast object validation. Digit. Investig. 4, SUPPL., 2–12 (2007). https://doi.org/10.1016/j.diin.2007.06.017.

  10. Garfinkel, S.L., McCarrin, M.: Hash-based carving: Searching media for complete files and file fragments with sector hashing and hashdb. In: Proceedings of Digit. Forensic Res. Conf. DFRWS 2015 USA. 14, pp. S95–S105 (2015). https://doi.org/10.1016/j.diin.2015.05.001.

  11. Gladyshev, P., James, J.I.: Decision-theoretic file carving (2017)

    Google Scholar 

  12. Laurenson, T.: Performance analysis of file carving tools. IFIP Adv. Inf. Commun. Technol. 405, 419–434 (2013). https://doi.org/10.1007/978-3-642-39218-4_31

    Article  Google Scholar 

  13. Odogwu, K.C., et al.: PNG Data Detector for DECA. Forensic Sci. Int. Digit. Investig. 32, 300910 (2020). https://doi.org/10.1016/j.fsidi.2020.300910

    Article  Google Scholar 

  14. Pahade, R.K., et al.: A survey on multimedia file carving. Int. J. Comput. Sci. Eng. Surv. 6(6), 27–46 (2015). https://doi.org/10.5121/ijcses.2015.6603

    Article  Google Scholar 

  15. Pal, A., et al.: Detecting file fragmentation point using sequential hypothesis testing. Digit. Investig. 5(SUPPL.), 2–13 (2008). https://doi.org/10.1016/j.diin.2008.05.015.

  16. Pal, A., Memon, N.: The evolution of file carving. IEEE Signal Process. Mag. 26(2), 59–71 (2009). https://doi.org/10.1109/MSP.2008.931081

    Article  Google Scholar 

  17. Poisel, R., et al.: Advanced file carving approaches for multimedia files. J. Wirel. Mob. Networks, Ubiquitous Comput. Dependable Appl. 2(4), 42–58 (2011)

    Google Scholar 

  18. Prasanthi, B.V.: Cyber forensic tools: a review. Int. J. Eng. Trends Technol. 41(5), 266–271 (2016). https://doi.org/10.14445/22315381/ijett-v41p249.

  19. Pungila, C.: Improved file-carving through data-parallel pattern matching for data forensics. In: SACI 2012 - 7th IEEE  International Symposium on Applied Computational Intelligence and Informatics, Proceedings, pp. 197–202 (2012). https://doi.org/10.1109/saci.2012.6250001

  20. Pungila, C.: Towards Efficient Structural Mapping of Files In Data Forensics. xx

    Google Scholar 

  21. Sitompul, O.S., et al.: A file undelete with Aho-Corasick algorithm in file recovery. In: 2016 International Conference on Informatics and Computing, ICIC 2016. lCIC, pp. 427–431 (2017). https://doi.org/10.1109/IAC.2016.7905757.

  22. Thing, V.L.L., et al.: Design of a digital forensics evidence reconstruction system for complex and obscure fragmented file carving. In: Proceedings - 2011 7th International Conference on Computational Intelligence and Security, CIS 2011, pp. 793–797 (2011). https://doi.org/10.1109/CIS.2011.180.

  23. Uzun, E., Sencar, H.T.: Carving orphaned jpeg file fragments. IEEE Trans. Inf. Forensics Secur. 10(8), 1549–1563 (2015). https://doi.org/10.1109/TIFS.2015.2416685

    Article  Google Scholar 

  24. Uzun, E., Sencar, H.T.: Jpg Scraper: An Advanced Carver for JPEG Files. IEEE Trans. Inf. Forensics Secur. 1 (2019). https://doi.org/10.1109/tifs.2019.2953382.

  25. Veenman, C.J.: Statistical disk cluster classification for file carving. Proceedings - IAS 2007 3rd Internationl Symposium on Information Assurance and Security, pp. 393–398 (2007). https://doi.org/10.1109/IAS.2007.75.

  26. Zha, X., Sahni, S.: Fast in-place file carving for digital forensics. Lect. Notes Inst. Comput. Sci. Soc. Telecommun. Eng. 56, 141–158 (2011). https://doi.org/10.1007/978-3-642-23602-0_13.

  27. Khor, H.L., Liew, S.C., Zain, J.M.: Region Of Interest-Based Tamper Detection And Lossless Recovery Watermarking Scheme (ROI-DR) on ultrasound medical images. J. Digit. Imaging 30(3), 328–349 (2017)

    Google Scholar 

Download references

Acknowledgement

This work is supported by RDU1803163 supported by Universiti Malaysia Pahang.

Author information

Authors and Affiliations

  1. Faculty of Computing, College of Computing and Applied Sciences, University Malaysia Pahang, 26600, Pekan, Pahang, Malaysia

    Nor Ika Shahirah Ramli, Syifak Izhar Hisham & Mohd Faizal Abd Razak

Authors
  1. Nor Ika Shahirah Ramli
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Syifak Izhar Hisham
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Mohd Faizal Abd Razak
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Syifak Izhar Hisham .

Editor information

Editors and Affiliations

  1. College of Computer Science and Engineering, Taibah University, Medina, Saudi Arabia

    Faisal Saeed

  2. School of Computing, Information Systems Department, Universiti Utara Malaysia, Sintok, Malaysia

    Fathey Mohammed

  3. Sanaa’a Community College, Sana'a, Yemen

    Abdulaziz Al-Nahari

Rights and permissions

Reprints and permissions

Copyright information

© 2021 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Ramli, N.I.S., Hisham, S.I., Razak, M.F.A. (2021). Survey of File Carving Techniques. In: Saeed, F., Mohammed, F., Al-Nahari, A. (eds) Innovative Systems for Intelligent Health Informatics. IRICT 2020. Lecture Notes on Data Engineering and Communications Technologies, vol 72. Springer, Cham. https://doi.org/10.1007/978-3-030-70713-2_74

Download citation

Publish with us

Policies and ethics