A Comprehensive Literature Review of File Carving

Abstract

File carving is a recovery technique allowing file recovery without knowledge about contextual information such as file system metadata. Due to recent advancements in research, file carving has become an essential technique for both general data recovery and digital forensics investigations. During the last few years a considerable amount of publications has been published on the topic of file carving. Out of around 130 publications in this field we selected 70 key papers with major contributions to the topic in order to identify potential fields of future research activities. The first contribution of this paper is a survey on state-of-the-art literature supporting researchers and practitioners in gaining a comprehensive view on the progress in file carving research. In addition to that, the second major contribution of this paper is a (preliminary) file carving ontology. The purpose of the ontology presented within this paper is to push forward recovery approaches that are based on knowledge bases processible by computer systems.