![]() Another example is the hard disks and removablestorage media US Navy Seals took from Osama Bin Laden’s campus during their raid. In certaincases related to child pornography, law enforcement agents are often able to recover more images fromthe suspect’s hard disks by using carving techniques. Carving is alsoespecially useful in criminal cases where the use of carving techniques can recover evidence. The block of data is searchedblock by block for residual data matching the file type-specific header and footer values. File carving is a powerful technique for recoveringfiles and fragments of files when directory entries are corrupt or missing. The files are “carved” from the unallocatedspace using file type-specific header and footer values.File system structures are not used during the process. Data carving techniques frequently occur during a digital investigation when theunallocated file system space is analyzed to extract files. ![]() White Paper Introduction to File CarvingOverview “File carving,” or sometimes simply “carving,” is the process of extracting a collection of data froma larger data set. ![]() White Paper Introduction to File CarvingTable of ContentsOverview 3File Recovery Versus Carving 3FragmentationĕTooling 5 An example of using Photorec 6Mobile Phones 8 Development by the forensic community 10Conclusion 10References 10About the Authorđ0About McAfee Foundstone Education 10McAfee Foundstone Security Training Classes 11 White PaperIntroduction to File CarvingBy Christiaan BeekPrincipal Security ConsultantMcAfee® Foundstone® Professional Services
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |