Validation Algorithms Based on Content Characters and Internal Structure: The PDF File Carving Method

This paper presents a new carving method for automatically and effectively carving PDF files from an unstructured digital forensic image. The carving method has five validation algorithms based on the content characters and the internal structure of PDF files. These validation algorithms include header/file length/maximal offset of objects/footer validation, internal structure validation, entropy difference validation, zlib/deflate decompression validation and character table validation. Effectively reassembling PDF file fragments including out-of-order fragments, exactly carving PDF files without any manual intervention, lower "false positives" are the advantage of this method. The PDF file carving method and other carving applications are illustrated over real world data using the DFRWS 2007 carving challenge dataset. The results show that this method is better than otherpsilas.