Advanced file carving - SANS Computer Forensics

More documents

Recommendations

Info

Links 1/3 • General forensic tools: • Encase: www.guidancesoftware.com • FTK: www.accessdata.com • General purpose carvers: • Scalpel: www.digitalforensicssolutions.com/scalpel • Foremost: foremost.sourceforge.net • Photorec: cgsecurity.org • Revit: revit.sourceforge.net
Links 2/3 • Specific purpose carvers and tools • Cohen carver: www.pyflag.net • Adroit: digital-assembly.com • Netanalysis: digital-detective.co.uk • Libmsiecf: libmsiecf.sourceforge.net • Reglookup: projects.sentinal-chicken.org/reglookup • Libpff: libpff.sourceforge.net • Libraries and other tools: • Libewf: libewf.sourceforge.net • Ssdeep: ssdeep.sourceforge.net
Page 1 and 2: Advanced file carving How much evid
Page 3 and 4: About this presentation Based on a
Page 5 and 6: Topic 2 - File Systems and Fragment
Page 7 and 8: FAT File Allocation FAT File System
Page 9 and 10: JPEG file structure • JPEG header
Page 11 and 12: File Structure Based Carving • Th
Page 13 and 14: Carving problems • Time consuming
Page 15 and 16: Quality of the results Recovered In
Page 17 and 18: Tools and datasets • Tools • Sc
Page 19 and 20: Tool quality - DFRWS 2006 Tool Carv
Page 21 and 22: Carving quality conclusion • Huge
Page 23 and 24: Specific purpose carver examples
Page 25 and 26: Adroit: Graph Theoretic Carvers •
Page 27 and 28: Adroit: Matching Metric between blo
Page 29 and 30: Adroit: Parallel Unique Path • Re
Page 31 and 32: Adroit • PUP by itself is too slo
Page 33: Questions?

Advanced file carving - SANS Computer Forensics

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?