Paper about In-Place File Carving
Golden G. Richard III, Vassil Roussev and Lodovico Marziale describe a file carver that is able to work on local and remote drives. They presented their paper In-Place File Carving at the 3rd annual IFIP WG 11.9 International Conference.
The article explains the whole concept of in-place file carving. The authors give the example of a 8 GB drive. The process of carving came to an abrupt end as the files produced exceeded the storage capacity of the 250 GB target drive. Beside the extra storage capacity the recreation of carved files takes a significant amount of time.
The paper also describes the architecture of an in-place carver which works on top of FUSE, the user space file system. The authors add a "preview" mode, that is in-place carving, to their well-known file carver scalpel.
Back to the example, the in-place carver produced only 62 MB of meta-data, which allowed to locate over 1 million of files. For more constrained sets of file types the reported savings in disk space and computing time are also dramatic.
