Back to articles
Articles
Volume: 29 | Article ID: art00005
Image
Benefits of combining forensic image creation and file carving
  DOI :  10.2352/ISSN.2470-1173.2017.7.MWSF-321  Published OnlineJanuary 2017
Abstract

Typical tasks in a forensic investigation are data acquisition, checksum calculation, file recovery, or content identification. These tasks can be performed mostly without user interaction but are still time-consuming, especially when a large amount of data has to be processed. Individual tasks (or sub-tasks they have in common) often do not perform efficiently and the corresponding implementations could be improved. In this paper we present stream carving, an approach to speed up tasks that are typically performed in a forensic investigation. By identifying and combining similar or identical subtasks and parallelizing most data processing, we are able to decrease the overall processing time significantly. We implemented a stream carving tool that is able to copy, recover, and identify known visual content. The general idea behind stream carving can help developing forensic multi-purpose tools that run several tasks very efficiently.

Subject Areas :
Views 37
Downloads 0
 articleview.views 37
 articleview.downloads 0
  Cite this article 

York Yannikos, Martin Steinebach, Michael Rettig, "Benefits of combining forensic image creation and file carvingin Proc. IS&T Int’l. Symp. on Electronic Imaging: Media Watermarking, Security, and Forensics,  2017,  pp 22 - 27,  https://doi.org/10.2352/ISSN.2470-1173.2017.7.MWSF-321

 Copy citation
  Copyright statement 
Copyright © Society for Imaging Science and Technology 2017
72010604
Electronic Imaging
2470-1173
Society for Imaging Science and Technology