Investigating and Measuring Capabilities of the Forensics File Carving Techniques

Abstract

File carving is a type of digital forensics recovery technique which focuses on recovering files from digital media without using file system metadata. This technique can be used in several situations such as recovering deleted files or recovering files from storage media with corrupted or unknown file systems. This paper explores and discusses the existing theory of file carving techniques. We conduct experimental testing for some of the current state of the art carving tools. These experiments will measure various criteria such as precision, recall and overall system performance.