摘要
Fragmented File carving is an important technique in Digital Forensics to recover files from their fragments in the absence of file system allocation information. In this paper, the fragmented file carving problem is formulated as a graph theoretic problem. Using this model, we describe two algorithms, ＂Best Path Search＂ and ＂High Fragmentation Path Search＂, to perform file reconstruction and recovery. The best path search algorithm is a deterministic technique to recover the best file construction path. We show that this technique is more efficient and accurate than existing brute force techniques. In addition, a test was carried out to recover 10 files from their scattered fragments. The best path search algorithm was able to successfully recover all of them back to their original state. The high fragmentation path search technique involves a trade-off between the final score of the constructed path of the file and the file recovery time to allow a faster recovery process for highly fragmented files. Analysis shows that the accurate eliminations of paths have an accuracy of up to greater than 85%.
