int for(ensic){blog;}

"Chopstick" published two articles about CarvFS in his blog Chirashi Security.

By Andreas Schuster at 07/08/2007, 09:00 PM | Permalink

Golden G. Richard III, Vassil Roussev and Lodovico Marziale describe a file carver that is able to work on local and remote drives. They presented their paper In-Place File Carving at the 3rd annual IFIP WG 11.9 International Conference.

By Andreas Schuster at 05/21/2007, 04:00 PM | Permalink

One of the problems in file carving is to properly identify the borders of the former files. This especially holds true in case of fragmentation. In their submission to the DFRWS 2006 challenge Klayton Monroe and Jay Smith of KoreLogic Security and Andy Bair of MITRE (at that time) calculate the block-wise entropy to detect file boundaries and identify blocks which are unlikely to belong to a carved file.

By Andreas Schuster at 04/07/2007, 04:00 PM | Permalink

The two programs LibCarvPath and CarvFS implement the concept of in-place carving. Both were developed under the Open Computer Forensics Architecture framework.

By Andreas Schuster at 12/19/2006, 05:00 PM | Permalink

Golden Richard released version 1.60 of his file carver Scalpel. This version for the first time supports the concept of in-place carving.

By Andreas Schuster at 12/18/2006, 05:00 PM | Permalink

Carving is a common technique to recover deleted files. It usually requires a lot of disk space. Now an inproved technique, called in-place, in-line or zero space carving, is going to change that - and it also noticeable speeds up processing.

By Andreas Schuster at 12/17/2006, 05:55 PM | Permalink

On Feb. 13th Scalpel v1.54 and Foremost v.1.1 were released to the public. Both are file carvers, so why not let them compete against each other?

(Dieser Beitrag ist auch auf Deutsch verfügbar.)

By Andreas Schuster at 02/18/2006, 10:30 PM | Permalink

Tcpxtract is a carver for network traffic, which means it extracts files out of captured data. In order to determine start and end positions of a file it searches for certain byte sequences. This procedure was inspired by foremost, a carver for filesystem data.

By Andreas Schuster at 10/13/2005, 05:35 PM | Permalink