süzen, ahmet ali süleyman demirel university - uluborlu vocational school - department of information security technology, Isparta, Turkey , taşdelen, kubilay süleyman demirel university - faculty of technology - department of electrical electronics engineering, Isparta, Turkey

Recovering Multimedia Files from a Memory Image

29460

The widespread use of digital technologies increases the size of data stored in digital media. The increased amount of stored data also brings along data security risks. One of the most important risks in personal data security is the unauthorized or accidental data deletion. There are file recovery and carving software for recovering deleted files from the storage devices. Files must be loaded into RAM to be used in the operating system. These files are stored in RAM for a certain amount of time by the memory manager. Therefore, a file opened or deleted by the user in the operating system can be found in the RAM. File carving techniques must be applied to RAM to access these files.In this study, the file carving and the performance values of the multimedia files carved by using different signature structures with file carving software from the RAM image were compared. In the study, carving has been performed with the header and footer signatures of the used and terminated multimedia files (JPG, PNG, GIF, BMP) used in Windows 10 operating system. In the carving process, file carving durations and carving success rates are extracted using different signature structures of the same file type. In the light of these results, the performance data of multimedia file types are evaluated according to the signature structures used. The RAM image retrieval and file carving software used in the study has been developed by us as a part of the Ph.D. project.

731

Data recovery , file carving , multimedia files , RAM image

Journal Of Polytechnic

737