TY - GEN
T1 - Recovery of damaged compressed files for digital forensic purposes
AU - Park, Bora
AU - Savoldi, Antonio
AU - Gubian, Paolo
AU - Park, Jungheum
AU - Lee, Seok Hee
AU - Leer, Sangjin
PY - 2008
Y1 - 2008
N2 - Nowadays compressed files are very widespread and can be considered, without any doubt, with regard to the Digital Forensic realm, an important and precious source of probatory data. This is especially true when in a digital investigation the examiner has to deal with corrupted compressed files, which have been gathered in the collection phase of the investigative process. Therefore, in the computer forensic field, data recovery technologies are very important for acquiring useful pieces of data which can become, in a court of low, digital evidence. This kind of technology is used not only by law enforcement, but also by the multitude of users in their daily activities, which justify the relevant presence of tools in the software market which are devoted to rescue data from damaged compressed files. However, state-of-the-art data recovery tools have many limitations with regard to the capability of recovering the original data, especially in the case of damaged compressed files. So far, such recovery tools have been based on a schema which controls the signature/header of the file and, thus, provides the offset to the raw compressed data block. As a result, they cannot recover the compressed files if the first part of the raw compressed data block, which pertains to the header, is damaged or the signature/header block is corrupted. Therefore, in order to deal with this issue, we have developed a new tool capable of rescuing damaged compressed files, according to the DEFLATE compression scheme, even though the header block is missing or corrupted. This represents a new interesting opportunity for the digital forensic discipline.
AB - Nowadays compressed files are very widespread and can be considered, without any doubt, with regard to the Digital Forensic realm, an important and precious source of probatory data. This is especially true when in a digital investigation the examiner has to deal with corrupted compressed files, which have been gathered in the collection phase of the investigative process. Therefore, in the computer forensic field, data recovery technologies are very important for acquiring useful pieces of data which can become, in a court of low, digital evidence. This kind of technology is used not only by law enforcement, but also by the multitude of users in their daily activities, which justify the relevant presence of tools in the software market which are devoted to rescue data from damaged compressed files. However, state-of-the-art data recovery tools have many limitations with regard to the capability of recovering the original data, especially in the case of damaged compressed files. So far, such recovery tools have been based on a schema which controls the signature/header of the file and, thus, provides the offset to the raw compressed data block. As a result, they cannot recover the compressed files if the first part of the raw compressed data block, which pertains to the header, is damaged or the signature/header block is corrupted. Therefore, in order to deal with this issue, we have developed a new tool capable of rescuing damaged compressed files, according to the DEFLATE compression scheme, even though the header block is missing or corrupted. This represents a new interesting opportunity for the digital forensic discipline.
UR - http://www.scopus.com/inward/record.url?scp=51249112042&partnerID=8YFLogxK
U2 - 10.1109/MUE.2008.49
DO - 10.1109/MUE.2008.49
M3 - Conference contribution
AN - SCOPUS:51249112042
SN - 0769531342
SN - 9780769531342
T3 - Proceedings - 2008 International Conference on Multimedia and Ubiquitous Engineering, MUE 2008
SP - 365
EP - 372
BT - Proceedings - 2008 International Conference on Multimedia and Ubiquitous Engineering, MUE 2008
T2 - 2008 International Conference on Multimedia and Ubiquitous Engineering, MUE 2008
Y2 - 24 April 2008 through 26 April 2008
ER -