TY - GEN
T1 - Study on a carving method for deleted NTFS compressed files
AU - Yoo, Byeongyeong
AU - Park, Jungheum
AU - Bang, Jewan
AU - Lee, Sangjin
PY - 2010
Y1 - 2010
N2 - File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. NTFS supports a compression function for internal files itself. However, the NTFS compression function has not been considered in the file carving. Thus, most of file carving tools cannot recover NTFS compressed files. This study describes the limitation in the existing file carving tools for the NTFS compressed files and proposes a recovering method for deleted NTFS compressed files.
AB - File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. NTFS supports a compression function for internal files itself. However, the NTFS compression function has not been considered in the file carving. Thus, most of file carving tools cannot recover NTFS compressed files. This study describes the limitation in the existing file carving tools for the NTFS compressed files and proposes a recovering method for deleted NTFS compressed files.
KW - Digital forensic
KW - File carving
KW - NTFS compressed files
UR - http://www.scopus.com/inward/record.url?scp=77958193048&partnerID=8YFLogxK
U2 - 10.1109/HUMANCOM.2010.5563317
DO - 10.1109/HUMANCOM.2010.5563317
M3 - Conference contribution
AN - SCOPUS:77958193048
SN - 9781424475704
T3 - 2010 3rd International Conference on Human-Centric Computing, HumanCom 2010
BT - 2010 3rd International Conference on Human-Centric Computing, HumanCom 2010
T2 - 2010 3rd International Conference on Human-Centric Computing, HumanCom 2010
Y2 - 11 August 2010 through 13 August 2010
ER -