Back to articles
Volume: 29 | Article ID: art00005
Benefits of combining forensic image creation and file carving
  DOI :  10.2352/ISSN.2470-1173.2017.7.MWSF-321  Published OnlineJanuary 2017

Typical tasks in a forensic investigation are data acquisition, checksum calculation, file recovery, or content identification. These tasks can be performed mostly without user interaction but are still time-consuming, especially when a large amount of data has to be processed. Individual tasks (or sub-tasks they have in common) often do not perform efficiently and the corresponding implementations could be improved. In this paper we present stream carving, an approach to speed up tasks that are typically performed in a forensic investigation. By identifying and combining similar or identical subtasks and parallelizing most data processing, we are able to decrease the overall processing time significantly. We implemented a stream carving tool that is able to copy, recover, and identify known visual content. The general idea behind stream carving can help developing forensic multi-purpose tools that run several tasks very efficiently.

Subject Areas :
Views 27
Downloads 0
 articleview.views 27
 articleview.downloads 0
  Cite this article 

York Yannikos, Martin Steinebach, Michael Rettig, "Benefits of combining forensic image creation and file carvingin Proc. IS&T Int’l. Symp. on Electronic Imaging: Media Watermarking, Security, and Forensics,  2017,  pp 22 - 27,

 Copy citation
  Copyright statement 
Copyright © Society for Imaging Science and Technology 2017
Electronic Imaging
Society for Imaging Science and Technology