• English
  • Deutsch
  • Log In
    Password Login
    Research Outputs
    Fundings & Projects
    Researchers
    Institutes
    Statistics
Repository logo
Fraunhofer-Gesellschaft
  1. Home
  2. Fraunhofer-Gesellschaft
  3. Artikel
  4. Syntactical Carving of PNGs and Automated Generation of Reproducible Datasets
 
  • Details
  • Full
Options
2019
Journal Article
Title

Syntactical Carving of PNGs and Automated Generation of Reproducible Datasets

Abstract
File carving is a technique to recover files from a storage medium without relying on a file system or other external metadata. As long as the files have been stored contiguously, most file formats are comparatively easy to carve. The moment files have been stored fragmented, the carving process becomes a highly complicated task-even when the fragmentation scenario is relatively simple-and most file carvers available today are not capable of restoring such files correctly. In this paper, we apply syntactical file carving, i.e. the process of utilizing the syntax of a file format to the maximum extent, to the PNG file format. By doing so, we show that the complexity of carving files even in very convoluted fragmentation scenarios can be significantly reduced. Furthermore, we provide a prototypical implementation of a syntactical PNG file carver. In our evaluation, the carver was able to restore 98% of the test files completely and correctly, while the remaining files were at least partially recovered. Since most of the publicly available file carving datasets do not contain PNG files, we created a custom dataset for our evaluation resembling the DFRWS forensic challenges from 2006 to 2007. To ease the creation of such datasets we implemented a dataset generation framework. Using our framework it is possible to create complex fragmentation scenarios with just a few lines of code and configuration. Through this, we hope to encourage the creation of publicly available datasets and to foster further research in the area of file carving.
Author(s)
Hilgert, J.-N.
Lambertz, M.
Rybalka, M.
Schell, R.
Journal
Digital Investigation  
Conference
Digital Forensics Research Conference (DFRWS) 2019  
Open Access
DOI
10.1016/j.diin.2019.04.014
Additional full text version
Landing Page
Language
English
Fraunhofer-Institut für Kommunikation, Informationsverarbeitung und Ergonomie FKIE  
  • Cookie settings
  • Imprint
  • Privacy policy
  • Api
  • Contact
© 2024