IT Forensics

There are frequent instances in which perpetrators attempt to cover their digital tracks by, for example, deleting files and overwriting the affected areas with other data. If fragments of such files that have not yet been overwritten still exist in a storage device, investigators can use file carving tools to identify and extract these file fragments and draw conclusions about the original file. In file carving, the software searches for typical byte sequences, such as the beginning or end of files (headers and footers) or specific data patterns of particular file types. If enough fragments of a deleted file are identified, it is often possible to infer the deleted file. Often, this can be partially or even completely recovered. Depending on the file type, different file carvers are required.

Multimedia File Carving Framework

Fraunhofer SIT has developed a framework for this purpose that combines the functionality of various multimedia file carvers with additional IT forensic analysis methods. Unlike conventional carvers, multimedia file carvers intelligently exploit the specific characteristics of stream-based multimedia data by not relying exclusively on the detection of header and footer data, but rather by analyzing, for example, an MPEG-1 video based on its internal structure. If a complete reconstruction of a multimedia file is not possible using header/footer detection, multimedia file carvers use the extracted information to restore individual parts of the multimedia data (e.g., frames in videos). Thus, while an IT forensic analyst may not obtain a fully reconstructed video, they can at least use a multimedia file carver to reconstruct various individual frames from that video and use them for further analysis. If, for example, the reconstructed file fragments are found in the investigators’ blacklists or whitelists, conclusions can be drawn regarding the prior existence of the original file on the storage medium. Fraunhofer SIT offers licenses for the Multimedia File Carving Framework or for individual components of the framework, which can be integrated into other forensic products as needed.