Advanced file carving - SANS Computer Forensics

More documents

Recommendations

Info

What does this mean in practice? Encase on DFRWS 2006 Photorec on DFRWS 2006
Carving quality conclusion • Huge difference in carver quality • On “simple” datasets, tools like Photorec and Revit get very good results • On more complex datasets the overall quality of the results is significantly lower • Fragmentation of <strong>file</strong>s can have a major impact on the quality of the results
Page 1 and 2: Advanced file carving How much evid
Page 3 and 4: About this presentation Based on a
Page 5 and 6: Topic 2 - File Systems and Fragment
Page 7 and 8: FAT File Allocation FAT File System
Page 9 and 10: JPEG file structure • JPEG header
Page 11 and 12: File Structure Based Carving • Th
Page 13 and 14: Carving problems • Time consuming
Page 15 and 16: Quality of the results Recovered In
Page 17 and 18: Tools and datasets • Tools • Sc
Page 19: Tool quality - DFRWS 2006 Tool Carv
Page 23 and 24: Specific purpose carver examples
Page 25 and 26: Adroit: Graph Theoretic Carvers •
Page 27 and 28: Adroit: Matching Metric between blo
Page 29 and 30: Adroit: Parallel Unique Path • Re
Page 31 and 32: Adroit • PUP by itself is too slo
Page 33 and 34: Questions?
Page 35 and 36: Links 2/3 • Specific purpose carv

Advanced file carving - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?