Difference between pages "Libmsiecf" and "File Carving:SmartCarving"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
 
 
Line 1: Line 1:
{{Infobox_Software |
+
'''SmartCarving''' is a [[File Carving|file carving]] technique to recover fragmented files first proposed by [[User:PashaPal|A. Pal]], T. Sencar and [[User:NasirMemon|N. Memon]] in DFRWS 2008. The term '''Smart Carving''' was already used in [http://sandbox.dfrws.org/2006/mora/dfrws2006.pdf]
  name = libmsiecf |
+
  maintainer = [[Joachim Metz]] |
+
  os = [[Linux]], [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], [[Windows]] |
+
  genre = {{Analysis}} |
+
  license = {{LGPL}} |
+
  website = [http://code.google.com/p/libmsiecf/ code.google.com/p/libmsiecf/] |
+
}}
+
  
The '''libmsiecf''' package contains a library and applications to read the [[Internet Explorer History File Format | MSIE Cache File]] format.
+
SmartCarving utilizes a combination of structure based validation along with validation of each file's unique content. Results for the SmartCarving technique
 +
were demonstrated on fragmented jpegs in the DFRWS 2006 and DFRWS 2007 challenges. From these two challenges SmartCarving was able
 +
to recover all but one fragmented jpeg file.  
  
== Tools ==  
+
==History==
The libmsiecf package contains the following tools:  
+
[[User:NasirMemon|Memon]] et al.[1] presented an efficient algorithm based on a greedy heuristic and alpha-beta pruning for reassembling fragmented images.
* '''msiecfexport''', which exports the items stored in MSIECF files.
+
Building on this work, [[User:NasirMemon|Memon]] et al.[2] researched and introduced sequential hypothesis testing as a an effective mechanism for detecting fragmentation points of file. This paper won the best paper award for DFRWS 2008. The techniques presented in the paper were the foundation for the overall SmartCarving design.
* '''msiecfinfo''', which shows the information about MSIECF files.  
+
  
== Examples ==  
+
==Details==
 +
After identifying a header block of a specific file type, for example, jpeg, a SmartCarver will analyze each subsequent block to determine if it
 +
belongs or does not belong to the starting block. If a block is determined not to belong, then the file is assumed to be fragmented and the
 +
SmartCarving algorithm looks for the next fragment by matching the data of other available blocks with the first fragment. This process can be
 +
done in parallel for many files.
  
Exporting items from an index.dat:
+
==Applications==
<pre>
+
There are currently two applications available that utilize SmartCarving, both produced by Digital Assembly:
msiecfexport -m items index.dat
+
* [[Adroit Photo Forensics]]
</pre>
+
* Adroit Photo Recovery
  
Exporting recovered items from an index.dat:
+
== References ==
<pre>
+
* A. Pal and N. Memon, [http://digital-assembly.com/technology/research/pubs/ieee-trans-2006.pdf "Automated reassembly of file fragmented images using greedy algorithms"] in IEEE Transactions on Image processing, February 2006, pp 385­393
msiecfexport -m recovered index.dat
+
* A. Pal, T. Sencar and N. Memon, [http://digital-assembly.com/technology/research/pubs/dfrws2008.pdf "Detecting File Fragmentation Point Using Sequential Hypothesis Testing"], Digital Investigations, Fall 2008
</pre>
+
  
Exporting an index.dat from a Chinese Windows installation:
+
==External links==
<pre>
+
* [http://digital-assembly.com/products/adroit-photo-recovery/ Adroit Photo Recovery]
msiecfexport -c windows-936 index.dat
+
* [http://digital-assembly.com/products/adroit-photo-forensics/ Adroit Photo Forensics]
</pre>
+
* [http://digital-assembly.com/technology/ Link to SmartCarving Technology and Research]
 
+
* [http://digital-assembly.com Digital Assembly]
== History ==  
+
Libmsiecf was created by [[Joachim Metz]] in 2009, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
+
 
+
Libmsiecf is a rewrite of [http://sourceforge.net/projects/odessa/ pasco] with support for more recent versions of [[Internet Explorer History File Format | MSIE Cache Files]]
+
 
+
== See Also ==
+
* [[Internet Explorer History File Format | MSIE Cache Files]]
+
 
+
== External Links ==
+
* [http://code.google.com/p/libmsiecf/ Project site]
+
* [http://libmsiecf.sourceforge.net/ Old project site]
+

Revision as of 07:46, 27 July 2012

SmartCarving is a file carving technique to recover fragmented files first proposed by A. Pal, T. Sencar and N. Memon in DFRWS 2008. The term Smart Carving was already used in [1]

SmartCarving utilizes a combination of structure based validation along with validation of each file's unique content. Results for the SmartCarving technique were demonstrated on fragmented jpegs in the DFRWS 2006 and DFRWS 2007 challenges. From these two challenges SmartCarving was able to recover all but one fragmented jpeg file.

Contents

History

Memon et al.[1] presented an efficient algorithm based on a greedy heuristic and alpha-beta pruning for reassembling fragmented images. Building on this work, Memon et al.[2] researched and introduced sequential hypothesis testing as a an effective mechanism for detecting fragmentation points of file. This paper won the best paper award for DFRWS 2008. The techniques presented in the paper were the foundation for the overall SmartCarving design.

Details

After identifying a header block of a specific file type, for example, jpeg, a SmartCarver will analyze each subsequent block to determine if it belongs or does not belong to the starting block. If a block is determined not to belong, then the file is assumed to be fragmented and the SmartCarving algorithm looks for the next fragment by matching the data of other available blocks with the first fragment. This process can be done in parallel for many files.

Applications

There are currently two applications available that utilize SmartCarving, both produced by Digital Assembly:

References

External links