Skip to main content
SpringerLink
Log in

A study on multimedia file carving method

  • Published:
Multimedia Tools and Applications Aims and scope Submit manuscript

Abstract

File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9
Fig. 10
Fig. 11
Fig. 12
Fig. 13
Fig. 14
Fig. 15
Fig. 16
Fig. 17
Fig. 18
Fig. 19
Fig. 20
Fig. 21
Fig. 22

Similar content being viewed by others

References

  1. AVI File Format, http://www.alexander-noe.com/video/documentation/avi.pdf

  2. AVI RIFF File Reference, http://msdn.microsoft.com/en-us/library/ms779636(VS.85).aspx

  3. Brian Carrier, File System Forensic Analysis, Addison-Wesley Professional, 22 March 2005

  4. Garfinkel SL (2007) Carving contiguous and fragmented files with fast object validation. Digital Invesigation 4(1)

  5. Joachim Metz, “carving NTFS-compressed files”, Hoffmann Investigations, 2 September 2009, http://www.forensicfocus.com/carving-ntfs-compressed-files

  6. Library of Congress, “WAVE Audio File Format”, 6 December 2009

  7. Mikus NA (2005) An analysis of disc carving techniques, Master's thesis. Naval Postgraduate School, March 2005

  8. MP3 File Format, http://mpgedit.org/mpgedit/mpeg_format/mpeghdr.htm

  9. Sanderson P (2000) NTFS compression—a forensic view, Sanderson Forensics, October 2002

  10. WAVE File Format, http://web.archive.org/web/19991115123323/http://www.borg.com/~jglatt/tech/wave.htm

Download references

Acknowledgment

This work was supported by the IT R&D program of MKE/KEIT[10035157, Development of Digital Forensic Technologies for Real-Time Analysis].

Author information

Authors and Affiliations

  1. Center for Information Security Technologies, Korea University, Seoul, Republic of Korea

    Byeongyeong Yoo, Jungheum Park, Sungsu Lim, Jewan Bang & Sangjin Lee

Authors
  1. Byeongyeong Yoo
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jungheum Park
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Sungsu Lim
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Jewan Bang
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Sangjin Lee
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Sangjin Lee.

Rights and permissions

Reprints and permissions

About this article

Cite this article

Yoo, B., Park, J., Lim, S. et al. A study on multimedia file carving method. Multimed Tools Appl 61, 243–261 (2012). https://doi.org/10.1007/s11042-010-0704-y

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11042-010-0704-y

Keywords

Search

Navigation