Advanced file carving - SANS Computer Forensics

More documents

Recommendations

Info

Topic 1 - (File) Carving Carving is a general term for extracting structured data (<strong>file</strong>s) out of raw data, based on format specific characteristics present in the structured data.
Topic 2 - File Systems and Fragmentation • Files are stored in <strong>file</strong> systems • Windows (FAT 12/16/32, NTFS) • Linux (Ext2/Ext3/Ext4, Reiser) • Mac (HFS, HFS+/HFSX) • File systems store data in clusters or blocks • Files are usually stored sequentially by the OS on media
Page 1 and 2: Advanced file carving How much evid
Page 3: About this presentation Based on a
Page 7 and 8: FAT File Allocation FAT File System
Page 9 and 10: JPEG file structure • JPEG header
Page 11 and 12: File Structure Based Carving • Th
Page 13 and 14: Carving problems • Time consuming
Page 15 and 16: Quality of the results Recovered In
Page 17 and 18: Tools and datasets • Tools • Sc
Page 19 and 20: Tool quality - DFRWS 2006 Tool Carv
Page 21 and 22: Carving quality conclusion • Huge
Page 23 and 24: Specific purpose carver examples
Page 25 and 26: Adroit: Graph Theoretic Carvers •
Page 27 and 28: Adroit: Matching Metric between blo
Page 29 and 30: Adroit: Parallel Unique Path • Re
Page 31 and 32: Adroit • PUP by itself is too slo
Page 33 and 34: Questions?
Page 35 and 36: Links 2/3 • Specific purpose carv

Advanced file carving - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?