DocumentCode
2130077
Title
A Comprehensive Literature Review of File Carving
Author
Poisel, R. ; Tjoa, S.
Author_Institution
Inst. of IT Security Res., St. Poelten Univ. of Appl. Sci., St. Polten, Austria
fYear
2013
fDate
2-6 Sept. 2013
Firstpage
475
Lastpage
484
Abstract
File carving is a recovery technique allowing file recovery without knowledge about contextual information such as file system metadata. Due to recent advancements in research, file carving has become an essential technique for both general data recovery and digital forensics investigations. During the last few years a considerable amount of publications has been published on the topic of file carving. Out of around 130 publications in this field we selected 70 key papers with major contributions to the topic in order to identify potential fields of future research activities. The first contribution of this paper is a survey on state-of-the-art literature supporting researchers and practitioners in gaining a comprehensive view on the progress in file carving research. In addition to that, the second major contribution of this paper is a (preliminary) file carving ontology. The purpose of the ontology presented within this paper is to push forward recovery approaches that are based on knowledge bases processible by computer systems.
Keywords
digital forensics; knowledge based systems; meta data; ontologies (artificial intelligence); digital forensics investigations; file carving ontology; file recovery; file system metadata; forward recovery approaches; general data recovery; knowledge bases; literature review; recovery technique; Accuracy; Computers; Digital forensics; Ontologies; Support vector machines; Transform coding; Classification; Data Recovery; Digital Forensics; File; File Carving; Fragment; Knowledge Base; Ontology;
fLanguage
English
Publisher
ieee
Conference_Titel
Availability, Reliability and Security (ARES), 2013 Eighth International Conference on
Conference_Location
Regensburg
Type
conf
DOI
10.1109/ARES.2013.62
Filename
6657278
Link To Document