Turn: File carving of AVI files in electronic forensics

File carving of AVI files in electronic forensics collection This article shares

1 introduction in the work of electronic forensics, the restoration of deleted data in digital equipment is one of the most important tasks, the recovery of data is dependent on the system meta-information of the traditional data recovery technology and do not rely on system meta-information of the file carving. The idea of file carving is to "carve" out the "shape" of certain files from a number "plane" under the condition of automatic or minimal manual intervention. This idea arises from the fact that when the system meta information is not trusted or corrupted, it causes all the file data in the data area to be non-discriminating and can only be "carved" out of the file in this "no-difference" data area by using file carving technology based on the structure and content characteristics of the file. Therefore, the technology of data recovery based on the idea of file carving is called the document carving and restoration. When the video AVI file forensics, often encountered even in the absence of coverage risk, the recovery of the video is not complete. The reason is that the traditional data recovery technology through the system meta-information data recovery does not have the ability to detect data, once the system meta-information is incomplete, even if the data remains in the digital device, it can not be restored. Without the system meta-information that can be relied on, the only thing we can do is to use the structure and content characteristics of AVI file, detect each "unallocated" data cluster in "No difference" data area, and judge if they are not the video fragment data we expect to get. In a neglected system meta-information environment, how to detect each AVI file fragments, and put them in order to link up, this is the focus of this paper. 2 article (total 5

Turn: File carving of AVI files in electronic forensics