Abstract
Recovering deleted files play an important role in a digital forensic investigation. When a file is deleted, only pointers that link file's metadata to its content are deleted and metadata entry is marked as deleted. As long as data is not overwritten or wiped, deleted data will remain in unallocated space. One of the methods that can be used to recover these deleted files is file carving. File carving reconstructs files only based on their content unlike traditional data recovery methods that use metadata that points to the content. It is mainly done using headers and footers of file types. One of the primary challenges in file carving is to recover deleted files that were fragmented. When a file is fragmented, carving only based on header and footer will produce corrupted file. So this paper discusses a method for carving fragmented document and image files from a FAT32 formatted USB drive.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
