Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Benefits of combining forensic image creation and file carving

: Yannikos, York; Steinebach, Martin; Rettig, Michael


Society for Imaging Science and Technology -IS&T-:
IS&T International Symposium on Electronic Imaging 2017. Media Watermarking, Security, and Forensics. Online resource : January 29, 2017 - February 2, 2017, Burlingame, California
Springfield/Va.: IS&T, 2017
International Symposium on Electronic Imaging (EI) <2017, Burlingame/Calif.>
Conference Paper
Fraunhofer SIT ()

Typical tasks in a forensic investigation are data acquisition, checksum calculation, file recovery, or content identification. These tasks can be performed mostly without user interaction but are still time-consuming, especially when a large amount of data has to be processed. Individual tasks (or sub-tasks they have in common) often do not perform efficiently and the corresponding implementations could be improved. In this paper we present stream carving, an approach to speed up tasks that are typically performed in a forensic investigation. By identifying and combining similar or identical subtasks and parallelizing most data processing, we are able to decrease the overall processing time significantly. We implemented a stream carving tool that is able to copy, recover, and identify known visual content. The general idea behind stream carving can help developing forensic multi-purpose tools that run several tasks very efficiently.