[GNHLUG] CentraLUG, November 6th: Andy Bair and Digital Forensic File Carving Techniques

[Ted Roche]

On Oct 23, 2006, at 9:41 AM, Ed Lawson wrote:

> What is file carving?  Slicing out files of interest?
>

Exactly right! In many investigations a computer forensics person  
might get a portion of a hard drive where some information (partition  
tables, allocation tables) has been overwritten or destroyed, and  
needs to attempt to extract files from what remains. Andy was on a  
forensic team that took such a challenge as part of a contest  with  
the Digital Forensic Research Workshop (http://www.dfrws.org) and  
then enhanced existing tools and developed some new techniques to  
make data carving easier.

Ted Roche
Ted Roche & Associates, LLC
http://www.tedroche.com