Abstract
An evidence file is a bit-stream copy of any digital storage media or a hard disk partition. Retrieving files from these evidence files without the intervention of file system is quite challenging as the storage locations where file contents are stored are unknown or the contents of files are unavailable in contiguous storage locations. In addition to this, portion of some of the deleted files might have been overwritten by new files. In this paper, we propose a method to carve bitmap files from evidence files by making use of the presence of slack area in the evidence file. The contiguous file filtering technique proposed in this paper makes the carving of fragmented files easier.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Pal, A., Memon, N.: The Evolution of File Carving. IEEE Signal Processing Magazine 26, 59–71 (2009)
Foremost 1.5.7, http://foremost.sourceforge.net/
Shanmugasundaram, K., Memon, N.: Automatic reassembly of document fragments via data compression. Presented at the 2nd Digital Forensics Research Workshop, Syracuse, NY (July 2002)
Carrier, B.: File System Forensic Analysis. Pearson Education, Addison-Wesley Professional, Boston, MA (2005)
Povar, D., Bhadran, V.K.: Forensic Data Carving. In: Baggili, I. (ed.) ICDF2C 2010. LNICST, vol. 53, pp. 137–148. Springer, Heidelberg (2011)
Boyre, R.S., Moore, J.S.: A Fast String Searching Algorithm. Communications of the ACM 20(10), 762–772 (1977)
Pal, A.: Automated Reassembly of File Fragmented Images using Greedy Algorithms, Master of Science Thesis, Polytechnic University, Brooklyn, New York (August 2005)
Loo, P.K., Tan, C.L.: Adaptive Region Growing Color Segmentation for Text Using Irregular Pyramid. In: IEEE Proc. Document Analysis Systems, pp. 264–275 (2004)
Martucci, S.A.: Reversible compression of HDTV images using median adaptive prediction and arithmetic coding. In: IEEE International Symposium on Circuits and Systems, vol. 2, pp. 1310–1313 (1990)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Chelliah, B., Vidyadharan, D.S., Shabana, P., Thomas, K.L. (2012). Carving of Bitmap Files from Digital Evidences by Contiguous File Filtering. In: Thampi, S.M., Zomaya, A.Y., Strufe, T., Alcaraz Calero, J.M., Thomas, T. (eds) Recent Trends in Computer Networks and Distributed Systems Security. SNDS 2012. Communications in Computer and Information Science, vol 335. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-34135-9_24
Download citation
DOI: https://doi.org/10.1007/978-3-642-34135-9_24
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-34134-2
Online ISBN: 978-3-642-34135-9
eBook Packages: Computer ScienceComputer Science (R0)