File carving for digital investigation

Abstract

File carving is the recovery of a file even when little information about the actual data or details of the file that stored it are found. Most file carvers today only focus on a few techniques of how the data could be recovered from on disk and get stuck if an early assumption is wrong or produces an incorrect file. This thesis focuses on exploring and building a file carving architecture for carving JPEG files. The architecture takes into consideration certain possible scenarios and structures of how the data is stored on a disk drive to avoid producing false positives with certain techniques. A set of rules have to be set which in turn control the decisions made by the carving architecture. The decisions are made by analysing the data and results produced after every step executed on these rules and from there the system would decide on what technique is used next or on which result it should be rolled back to. The logic that controls the frame work takes a non-monotonic approach meaning that no results are taken for granted and no critical decisions such as reconstructing a files are done before the results produced are positively correct or all the techniques possible were practiced. If no concrete result is found then the most reliable result is chosen and reconstructed into its respective format. This is possible by putting to work in parallel a database system designed to hold all the information found on the data, the results produced and all the decision made on which techniques are to be used. The database also provides an interface where the process of the results are examined closely step by step to better evaluate the system as a whole or independent file carving techniques.