Recovery of damaged compressed files for digital forensic purposes

Bora Park, Antonio Savoldi, Paolo Gubian, Jungheum Park, Seok Hee Lee, Sangjin Leer

Research output: Chapter in Book/Report/Conference proceedingConference contribution

9 Citations (Scopus)

Abstract

Nowadays compressed files are very widespread and can be considered, without any doubt, with regard to the Digital Forensic realm, an important and precious source of probatory data. This is especially true when in a digital investigation the examiner has to deal with corrupted compressed files, which have been gathered in the collection phase of the investigative process. Therefore, in the computer forensic field, data recovery technologies are very important for acquiring useful pieces of data which can become, in a court of low, digital evidence. This kind of technology is used not only by law enforcement, but also by the multitude of users in their daily activities, which justify the relevant presence of tools in the software market which are devoted to rescue data from damaged compressed files. However, state-of-the-art data recovery tools have many limitations with regard to the capability of recovering the original data, especially in the case of damaged compressed files. So far, such recovery tools have been based on a schema which controls the signature/header of the file and, thus, provides the offset to the raw compressed data block. As a result, they cannot recover the compressed files if the first part of the raw compressed data block, which pertains to the header, is damaged or the signature/header block is corrupted. Therefore, in order to deal with this issue, we have developed a new tool capable of rescuing damaged compressed files, according to the DEFLATE compression scheme, even though the header block is missing or corrupted. This represents a new interesting opportunity for the digital forensic discipline.

Original languageEnglish
Title of host publicationProceedings - 2008 International Conference on Multimedia and Ubiquitous Engineering, MUE 2008
Pages365-372
Number of pages8
DOIs
Publication statusPublished - 2008
Event2008 International Conference on Multimedia and Ubiquitous Engineering, MUE 2008 - Busan, Korea, Republic of
Duration: 2008 Apr 242008 Apr 26

Publication series

NameProceedings - 2008 International Conference on Multimedia and Ubiquitous Engineering, MUE 2008

Other

Other2008 International Conference on Multimedia and Ubiquitous Engineering, MUE 2008
Country/TerritoryKorea, Republic of
CityBusan
Period08/4/2408/4/26

ASJC Scopus subject areas

  • Computer Graphics and Computer-Aided Design
  • Computer Science Applications
  • Software

Fingerprint

Dive into the research topics of 'Recovery of damaged compressed files for digital forensic purposes'. Together they form a unique fingerprint.

Cite this