SLAMorris Final Thesis After Corrections.pdf - Cranfield University

a file from a storage device based upon its structure. It is commonly used when
the directory information is unavailable, to extract as much of the file as
possible. In the case of deleted files this may not be the complete file as it may
have been partially overwritten [Sammes, 2007]. The following sub-sections
discuss traditional data carving approaches; in Section 7.2.1 the brute force
approach to data carving is described. This is followed by a description of
structural and syntactical data carving approaches in Section 7.2.2.
Figure 7-1: Traditional file carving from clusters of unallocated space on the
storage media
7.2.1 Brute Force Approach
File carving, or file recovery is the process of retrieving complete or partial files
from the storage media when there is no file system information available. Early
file carving methods were based on identifying the header and footer of a file
and then carving out all the information between these two points; this provides
Page
159