Text File Recovery Using an N-Gram Model
摘要
This chapter describes a file carving method for recovering deleted text files without relying on file table information. Specifically, text files are reconstructed by analyzing file fragments and utilizing three n-gram language models, the absolute discounting interpolated trigram language model, absolute discounting interpolated bigram language model and Laplace bigram language model. The method selects text files and segments them into blocks that are copied to a memory buffer in random order to simulate the file allocation process. Graph theory is employed to formulate the text file recovery problem with clusters as nodes and probabilities of successor clusters as edges. The absolute discounting interpolated trigram language model yielded the highest average accuracy of 79.19%. The results underscore the effectiveness of leveraging linguistic patterns inherent in fragmented data to restore lost text content.