Earticle

초록

영어

Nowadays compressed files are very widespread and can be considered, without any doubt, with regard to the Digital Forensic realm, an important and precious source of probatory data. This is especially true when in a digital investigation the examiner has to deal with corrupted compressed files, which have been gathered in the collection phase of the investigative process. Therefore, in the computer forensic field, data recovery technologies are very important for acquiring useful pieces of data which can become, in a court of low, digital evidence. This kind of technology is used not only by law enforcement, but also by the multitude of users in their daily activities, which justify the relevant presence of tools in the software market which are devoted to rescue data from damaged compressed files. However, state-of-the-art data recovery tools have many limitations with regard to the capability of recovering the original data, especially in the case of damaged compressed files. So far, such recovery tools have been based on a schema which controls the signature/header of the file and, thus, provides the offset to the raw compressed data block. As a result, they cannot recover the compressed files if the first part of the raw compressed data block, which pertains to the header, is damaged or the signature/header block is corrupted. Therefore, in order to deal with this issue, we have developed a new tool capable of rescuing damaged compressed files, according to the DEFLATE compression scheme, even though the header block is missing or corrupted. This represents a new interesting opportunity for the digital forensic discipline.

목차

Abstract
 1: Introduction
 2: Related Work
  2.1: Data Recovery Algorithms: State-of-the-art
  2.2: Limitations of Current Data Recovery Tools
 3: Compression and Decompression Algorithms
  3.1: Basic Principle of DEFLATE Compression Algorithm
  3.2: Types of Compression Modes in DEFLATE Algorithm
  3.3: Basic Principle of INFLATE Decompression Algorithm
 4: A New Method for Rescuing Damaged Raw Compressed Files
  4.1: Damaged Raw Data: Possible Scenario
  4.2: Decompression Helper
 5: Experimental Results
 6: Conclusion and Future Works
 7 Acknowledgments
 References

저자

• Bora Park [ Center for Information Security Technologies, Korea University, Seoul, Korea ]
• Antonio Savoldi [ Department of Electronics for Automation, University of Brescia, Via Branze 38, Brescia, Italy ]
• Paolo Gubian [ Department of Electronics for Automation, University of Brescia, Via Branze 38, Brescia, Italy ]
• Jungheum Park [ Center for Information Security Technologies, Korea University, Seoul, Korea ]
• Seok Hee Lee [ Center for Information Security Technologies, Korea University, Seoul, Korea ]
• Sangjin Lee [ Center for Information Security Technologies, Korea University, Seoul, Korea ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Hybrid Information Technology

• 간기

  격월간

• pISSN

  1738-9968

• 수록기간

  2008~2016

• 십진분류

  KDC 505 DDC 605