SLAMorris Final Thesis After Corrections.pdf - Cranfield University

7.3.1 Statistical Methods
If document fragments can be identified as belonging to the same file it is
possible to reassemble them using statistical modelling based upon the
expected context of the file [Shanmugasundaram, 2003]. The fragments are
added to a graph with the probability of adjacency to other fragments being
calculated and used as weights; the reassembled document is therefore
equivalent to picking the sequence of fragments with the highest probability of
being a structurally and syntactically valid file. Currently this is possible only for
files where all the fragments are available, making it useful in cases where the
directory structure is missing, but would not provide assistance reassembling
incomplete files. This algorithm can currently only find a solution when it is given
an input that consists solely of fragments from the file to be reassembled
[Memon, 2006]; it is unclear how fragments could be sorted into individual files
during an investigation to provide the necessary input. This research was
conducted by looking at a variety of file types including logs and binary files.
This implied the authors wanted to determine the effects of carving multiple file
types that may be relevant to an investigation rather than just focusing on a
specific structure such as OLE2 or jpeg.
Fragmentation of a file occurs when it is not possible to store the file in
contiguous sectors, such as when storing a large file. A fragment may be part of
a fragmented file or as little as a single cluster recovered from unallocated
space. Research has suggested that file fragmentation is not present on all
drives that an analyst would come across [Garfinkel, 2007]; this is in line with
the fact that different users have different needs from their computers and are
therefore likely to store varying amounts of information.
Garfinkel [2007] collected a series of hard drives from places such as eBay and
whilst examining them found that from the 51 NTFS file systems he examined
approximately 12.2% of files were in at least 2 fragments, with 6.6% being in 5
Page
162