Bin-Carver: Automatic recovery of binary executable files

Digital Investigation

Volumn 9, Issue SUPPL., 2012, Pages

  Hand, Scott ^a   Lin, Zhiqiang ^a   Gu, Guofei ^b   Thuraisingham, Bhavani ^a  

^a The University of Texas at Dallas   (United States)

^b Texas AandM University   (United States)

Author keywords

Binary code analysis; Digital forensics; ELF; File carving; File recovery; Fragmentation

Indexed keywords

BINARY CODES; CODES (SYMBOLS); COMPUTER CRIME; DIGITAL FORENSICS; FILE ORGANIZATION; MALWARE; METADATA; RECOVERY;

AUTOMATIC RECOVERY; BINARY CODE ANALYSIS; EXECUTABLE FILES; FILE CARVING; FILE RECOVERY; FRAGMENTATION; IDENTIFICATION RATES; ROAD MAP INFORMATION;

BINS;

EID: 84864576758     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2012.05.014     Document Type: Conference Paper

References (20)

1. E.W. Dijkstra A note on two problems in connexion with graphs Numerische Mathematik 1 1 1959 269 271
2. B. Dolan-Gavitt, A. Srivastava, P. Traynor, and J. Giffin Robust signatures for kernel data structures Proceedings of the 16th ACM Conference on Computer and Communications security (CCS'09) 2009 ACM Chicago, Illinois, USA 566 577
3. Executable and linkable format, http://wiki.osdev.org/ELF.
4. Foremost: a console program to recover files, http://foremost. sourceforge.net.
5. S. Garfinkel Carving contiguous and fragmented files with fast object validation Proceedings of the 7th Annual Digital Forensic Research Workshop (DFRWS) 2007
6. Jpeg file interchange format file format summary, http://www.fileformat. info/format/jpeg/egff.htm.
7. M. Karresand, and N. Shahmehri Oscar - file type identification of binary data in disk clusters and ram pages Security and Privacy in Dynamic Environments vol. 201 2006 IFIP International Federation for Information Processing 413 424 (Pubitemid 44920672)
8. M. Karresand, and N. Shahmehri File type identification of data fragments by their binary structure Information Assurance Workshop, 2006 2006 IEEE 140 147 (Pubitemid 46028750)
9. D.E. Knuth The art of computer programming 3rd ed. Fundamental algorithms vol. 1 1997 Addison Wesley Longman Publishing Co., Inc Redwood City, CA, USA
10. Z. Lin, J. Rhee, X. Zhang, D. Xu, and X. Jiang Siggraph: Brute force scanning of kernel data structure instances using graph-based signatures Proceedings of the 18th Annual Network and Distributed System Security Symposium (NDSS'11) 2011 San Diego, CA
11. Z. Lin, J. Rhee, C. Wu, X. Zhang, and D. Xu Dimsum: discovering semantic data of interest from un-mappable with confidence Proceedings of the 19th Annual Network and Distributed System Security Symposium (NDSS'12) 2012 San Diego, CA
12. M. McDaniel, and M.H. Heydari Content based file type detection algorithms Proceedings of the 36th Annual Hawaii International Conference on System Sciences (HICSS'03) - Track 9 vol. 9 2003
13. Microsoft pe and coff specification, http://msdn.microsoft.com/en-us/ windows/hardware/gg463119.aspx.
14. S. Moody, and R. Erbacher Sadi - statistical analysis for data type identification Systematic Approaches to Digital Forensic Engineering, SADFE '08 2008 Third International Workshop on, 2008. p. 41-54
15. A. Pal, H. Sencar, and N. Memon Detecting file fragmentation point using sequential hypothesis testing Digital Invest 5 Suppl. 1 2008
16. A. Pal, and N. Memon The evolution of file carving Signal Processing Magazine, IEEE 26 2 2009 59 71
17. A. Pal, K. Shanmugasundaram, and N. Memon Automated reassembly of fragmented images Proceedings of the 2003 International Conference on Multimedia and Expo ICME '03 vol. 2 2003 IEEE Computer Society Washington, DC, USA 625 628
18. G.G. Richard III, and V. Roussev Scalpel: a frugal, high performance file carver Proceedings of DFRWS 2005 2005
19. M. Sharif, V. Yegneswaran, H. Saidi, and P. Porras Eureka: a framework for enabling static analysis on malware Proceedings of the 13th European Symposium on Research in Computer Security 2008 LNCS Malaga, Spain
20. Year-end malware stats from av-test, http://www.gfi.com/blog/year-end- malware-stats-from-av-test/.