Design tradeoffs for developing fragmented video carving tools

Détails

Ressource 1Télécharger: paper-design_tradeoffs_for_developing_fragmented_video_carving_tools.pdf (2341.14 [Ko])
Etat: Public
Version: Final published version
ID Serval
serval:BIB_47677D68F0F2
Type
Article: article d'un périodique ou d'un magazine.
Collection
Publications
Titre
Design tradeoffs for developing fragmented video carving tools
Périodique
Digital Investigation
Auteur⸱e⸱s
Casey Eoghan, Zoun Rikkert
ISSN
1742-2876
Statut éditorial
Publié
Date de publication
2014
Volume
11
Pages
S30 - S39
Langue
anglais
Résumé
When conducting a digital forensic examination, there is sometimes a need to salvage as much playable video as possible from available data sources. Although an ideal outcome might be to have all deleted and partially overwritten file fragments identified, reassembled, and repaired to provide playable videos, there are situations where this is not possible. In addition, there are complexities in real world datasets that can lead to false positives and false negatives. This paper captures practical lessons learned from extensive experiences in this problem space, and describes tradeoffs that developers must consider when creating file carving tools for salvaging and reassembling fragmented AVI, MPEG, and 3GP video files. Recommendations are provided for each tradeoff, concentrating on increasing the amount of playable video fragments that can be salvaged, with the potential for duplicate copies of some fragments being salvaged. Developers need to carefully consider how to handle the tradeoffs described in this paper when developing fragmented video carving tools. In addition, digital investigators need to consider the strengths and limitations of different fragmented video carving methods, and need to select those that are best suited to their given dataset. Another important outcome of this work is that the products of some carving methods may be playable in one video viewer but not others, making it necessary to view carved results using various methods, including storyboarding. This paper also includes discussion of current challenges and potential future work in fragmented file carving, with the aim of advancing research and development of automated methods for reassembling salvaged video fragments.
Mots-clé
Data recovery, Digital forensics, File carving, File formats, DFRWS carving challenge, Fragmentation, Fragment reassembly
Open Access
Oui
Création de la notice
16/01/2019 21:06
Dernière modification de la notice
20/08/2019 13:53
Données d'usage