Advanced file carving - SANS Computer Forensics

More documents

Recommendations

Info

Topic 4 - Measuring quality • Determine quality criteria • Required features • Quality of the results • Determine the carving quality of a tool • Tools and datasets • Results
Quality of the results Recovered In dataset Yes Positive No Yes No False negative False positive “Recall”: What proportion of the available files is recovered? “Precision”: What proportion of the recovered files is correct? -
Page 1 and 2: Advanced file carving How much evid
Page 3 and 4: About this presentation Based on a
Page 5 and 6: Topic 2 - File Systems and Fragment
Page 7 and 8: FAT File Allocation FAT File System
Page 9 and 10: JPEG file structure • JPEG header
Page 11 and 12: File Structure Based Carving • Th
Page 13: Carving problems • Time consuming
Page 17 and 18: Tools and datasets • Tools • Sc
Page 19 and 20: Tool quality - DFRWS 2006 Tool Carv
Page 21 and 22: Carving quality conclusion • Huge
Page 23 and 24: Specific purpose carver examples
Page 25 and 26: Adroit: Graph Theoretic Carvers •
Page 27 and 28: Adroit: Matching Metric between blo
Page 29 and 30: Adroit: Parallel Unique Path • Re
Page 31 and 32: Adroit • PUP by itself is too slo
Page 33 and 34: Questions?
Page 35 and 36: Links 2/3 • Specific purpose carv

Advanced file carving - SANS Computer Forensics

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?