In certaincases related to child pornography, law enforcement agents are often able to recover more images fromthe suspect’s hard disks by using carving techniques.
Carving is alsoespecially useful in criminal cases where the use of carving techniques can recover evidence. The block of data is searchedblock by block for residual data matching the file type-specific header and footer values. File carving is a powerful technique for recoveringfiles and fragments of files when directory entries are corrupt or missing. The files are “carved” from the unallocatedspace using file type-specific header and footer values.File system structures are not used during the process. Data carving techniques frequently occur during a digital investigation when theunallocated file system space is analyzed to extract files. White Paper Introduction to File CarvingOverview “File carving,” or sometimes simply “carving,” is the process of extracting a collection of data froma larger data set. White Paper Introduction to File CarvingTable of ContentsOverview 3File Recovery Versus Carving 3FragmentationĕTooling 5 An example of using Photorec 6Mobile Phones 8 Development by the forensic community 10Conclusion 10References 10About the Authorđ0About McAfee Foundstone Education 10McAfee Foundstone Security Training Classes 11
#010 EDITOR CARVE OUT FILES PROFESSIONAL#
White PaperIntroduction to File CarvingBy Christiaan BeekPrincipal Security ConsultantMcAfee® Foundstone® Professional Services
0 kommentar(er)
