Sciweavers

SADFE
2009
IEEE

File Fragment Classification-The Case for Specialized Approaches

14 years 6 months ago
File Fragment Classification-The Case for Specialized Approaches
Increasingly advances in file carving, memory analysis and network forensics requires the ability to identify the underlying type of a file given only a file fragment. Work to date on this problem has relied on identification of specific byte sequences in file headers and footers, and the use of statistical analysis and machine learning algorithms taken from the middle of the file. We argue that these approaches are fundamentally flawed because they fail to consider the inherent internal structure in widely used file types such as PDF, DOC, and ZIP. We support our argument with a bottom-up examination of some popular formats and an analysis of TK PDF files. Based on our analysis, we argue that specialized methods targeted to each specific file type will be necessary to make progress in this area.
Vassil Roussev, Simson L. Garfinkel
Added 21 May 2010
Updated 21 May 2010
Type Conference
Year 2009
Where SADFE
Authors Vassil Roussev, Simson L. Garfinkel
Comments (0)