The contents of files are typically stored on disk in a consecutive manner. However, \(\sim \) 4% of files are fragmented – the contents is not stored on-disk in one continuous part. The fragments that together constitute the file may even be stored in non-consecutive order on-disk. This turns out to be a common occurrence: the WildFrag dataset (gathered by Van der Meer et al.) showed that almost half of fragmented files ( \(\sim \) 46%) are fragmented out of order. This is a type of fragmentation that, while not entirely overlooked, has received scant attention in the file carving literature. In this paper, we further analyse the WildFrag dataset to find insights which may impact the design of file carvers. Second, we propose an initial design and proof-of-concept implementation of a carver capable of handling out-of-order fragmentation. Lastly, we note a dearth of suitable disk image sets to test our implementation. We construct a test set generator which can generate disk images with tunable fragmentation patterns, setting fragmentation percentage, number of fragments per file, and the degree of ‘out-of-order’ness. We conclude that while this work shows out-of-order carving is feasible, it is still an open question how to do so efficiently in practical settings.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

How to Carve Out-of-Order Fragmented Files

  • Nick Huijsmans,
  • Bart Kuijsten,
  • Hugo Jonker,
  • Harm van Beek

摘要

The contents of files are typically stored on disk in a consecutive manner. However, \(\sim \) 4% of files are fragmented – the contents is not stored on-disk in one continuous part. The fragments that together constitute the file may even be stored in non-consecutive order on-disk. This turns out to be a common occurrence: the WildFrag dataset (gathered by Van der Meer et al.) showed that almost half of fragmented files ( \(\sim \) 46%) are fragmented out of order. This is a type of fragmentation that, while not entirely overlooked, has received scant attention in the file carving literature. In this paper, we further analyse the WildFrag dataset to find insights which may impact the design of file carvers. Second, we propose an initial design and proof-of-concept implementation of a carver capable of handling out-of-order fragmentation. Lastly, we note a dearth of suitable disk image sets to test our implementation. We construct a test set generator which can generate disk images with tunable fragmentation patterns, setting fragmentation percentage, number of fragments per file, and the degree of ‘out-of-order’ness. We conclude that while this work shows out-of-order carving is feasible, it is still an open question how to do so efficiently in practical settings.