Technical framework for file carving tools

Abstract EN

Governments and societies seek to combat crime of all kinds, including electronic crimes, which are where computing has a fundamental corner in it, such as if the evidence is inside the computer or the crime has been committed with it, and for this several techniques have emerged to deal with electronic evidence, including File Carving technology, which is a technology that works to restore files without relying on the structure of the file system and this is what distinguishes them from traditional restoration.

This technology has several tools, each tool depends on different algorithms as these algorithms are applied to the file depending on several requirements, including header, footer, or the contents of the file , And on this diversity and difference in algorithms and methods has led to the variation of each tool from the other, and this difference can be known by performing measurements experiments on tools, through a set of dataset to obtain several factors, namely the speed of recovery operations, recall, precision and The number of files retrieved.

properly show the disadvantages of these tools, such as fragmentation has been working on this address defects developed ways through which the restoration, such as Smart Carving, and this technology is still under work and employment and development.