File fragment classification - The case for specialized approaches

4th International Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2009

Volumn , Issue , 2009, Pages 3-14

  Roussev, Vassil ^a   Garfinkel, Simson L ^b  

^a USA   (United States)

^b NAVAL POSTGRADUATE SCHOOL   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

FILE CARVING; FILE FRAGMENTS; FILE HEADER; FILE TYPES; INTERNAL STRUCTURE; MACHINE LEARNING ALGORITHMS; MEMORY ANALYSIS; NETWORK FORENSICS; PDF FILES; STATISTICAL ANALYSIS;

COMPUTER CRIME; ELECTRONIC CRIME COUNTERMEASURES; LEARNING ALGORITHMS; PROBABILITY DENSITY FUNCTION; PROBABILITY DISTRIBUTIONS;

FORENSIC ENGINEERING;

EID: 74549153311     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SADFE.2009.21     Document Type: Conference Paper

References (18)

1. B. Carrier, E.Casey, W.Venema, DFRWS Forensic Challenge. http://dfrws.org/2006/challenge/. 2006.
2. C. Freiling, D. Jungreis, F. Théberge, K. Zeger. "Almost all complete binary prefix codes have a self-synchronizing string." IEEE Transactions on Information Theory. Vol 49(9), Sep 2003, pp. 2219-2225.
3. Calhoun WC, Coles D. "Predicting the types of file fragments." Proceedings of the 2008 DFRWS Conference, Baltimore, MD. Aug 2008. pp.146-157.
4. I. F. Darwin, "Libmagic,". ftp://ftp.astron.com/pub/file. 2008
5. Karresand M, Shahmehri N. "File Type Identification of Data Fragments by Their Binary Structure", Proceedings of the 7th Annual IEEE Information Assurance Workshop, "The West Point Workshop", pp 140-147, United States Military Academy, West Point, 21-23, New York, June 2006.
6. Karresand M, Shahmehri N. "Oscar - file type identification of binary data in disk clusters and RAM pages," in Proceedings of IFIP International Information Security Conference: Security and Privacy in Dynamic Environments (SEC2006), LNCS, p413-424. 2006.
7. th IEEE Information Assurance Workshop, West Point, NY, June, 2005.
8. McDaniel M, Heydari MH. "Content Based File Type Detection Algorithms." HICSS '03: Proceedings of the 36th Annual Hawaii International Conference on System Sciences (HICSS'03). 2003.
9. Microsoft, "Windows Compound Binary File Format Specification," 2007.
10. Moody SJ, Erbacher RF. SÁDI - Statistical Analysis for Data Type Identification. May 2008. Proceedings of the 3rd IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, Oakland, CA, May 2008, pp. 41-54.
11. P. Deutsch, J-L. Gailly. RFC 1950: "ZLIB Compressed Data Format Specification version 3.3". http://www.ietf.org/rfc/rfc1950.txt. 1996.
12. P. Deutsch. RFC 1951: "DEFLATE Compressed Data Format Specification version 1.3". http://www.ietf.org/rfc/rfc1951.txt. 1996.
13. R. Erbacher, J. Mulholland, "Identification and Localization of Data Types within Large-Scale File Systems," Proceedings of the 2nd International Workshop on Systematic Approaches to Digital Forensic Engineering, Seattle, WA, April 2007, pp. 55-70.
14. S. Garfinkel, J. Migletz, "The new XML Office Document Files," IEEE Security & Privacy Magazine, March/April 2009.
15. Sladen, P., pyflate. http://www.paul.sladen.org/projects/pyflate/
16. Veenman CJ. Statistical Disk Cluster Classification for File Carving. Proceedings of the First International Workshop on Computational Forensics, Manchester, UK, August 31, 2007.
17. W. Leland, M. Taqqu, W. Willinger, and D. Wilson. "On the self-similar nature of ethernet traffic." In Proc. ACM SIGCOMM '93, pages 183-193, 1993.
18. Welch, T. A. "A technique for high-performance data compression." Computer. Vol. 17, June 1984. pp. 8-19.