Advanced file carving - SANS Computer Forensics

More documents

Recommendations

Info

Links 3/3 • Datasets: • FAT: dftt.sourceforge.net/test11 • Ext2: dftt.sourceforge.net/test12 • DFRWS 2006: dfrws.org/2006/challenge • DFRWS 2007: dfrws.org/2007/challenge • Measuring <strong>file</strong> <strong>carving</strong> quality: • alexandria.tue.nl/extra1/afstversl/wsk-i/kloet2007.pdf
Page 1 and 2: Advanced file carving How much evid
Page 3 and 4: About this presentation Based on a
Page 5 and 6: Topic 2 - File Systems and Fragment
Page 7 and 8: FAT File Allocation FAT File System
Page 9 and 10: JPEG file structure • JPEG header
Page 11 and 12: File Structure Based Carving • Th
Page 13 and 14: Carving problems • Time consuming
Page 15 and 16: Quality of the results Recovered In
Page 17 and 18: Tools and datasets • Tools • Sc
Page 19 and 20: Tool quality - DFRWS 2006 Tool Carv
Page 21 and 22: Carving quality conclusion • Huge
Page 23 and 24: Specific purpose carver examples
Page 25 and 26: Adroit: Graph Theoretic Carvers •
Page 27 and 28: Adroit: Matching Metric between blo
Page 29 and 30: Adroit: Parallel Unique Path • Re
Page 31 and 32: Adroit • PUP by itself is too slo
Page 33 and 34: Questions?
Page 35: Links 2/3 • Specific purpose carv

Advanced file carving - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?