How to Carve Out-of-Order Fragmented Files
摘要
The contents of files are typically stored on disk in a consecutive manner. However, \(\sim \) 4% of files are fragmented – the contents is not stored on-disk in one continuous part. The fragments that together constitute the file may even be stored in non-consecutive order on-disk. This turns out to be a common occurrence: the WildFrag dataset (gathered by Van der Meer et al.) showed that almost half of fragmented files ( \(\sim \) 46%) are fragmented out of order. This is a type of fragmentation that, while not entirely overlooked, has received scant attention in the file carving literature. In this paper, we further analyse the WildFrag dataset to find insights which may impact the design of file carvers. Second, we propose an initial design and proof-of-concept implementation of a carver capable of handling out-of-order fragmentation. Lastly, we note a dearth of suitable disk image sets to test our implementation. We construct a test set generator which can generate disk images with tunable fragmentation patterns, setting fragmentation percentage, number of fragments per file, and the degree of ‘out-of-order’ness. We conclude that while this work shows out-of-order carving is feasible, it is still an open question how to do so efficiently in practical settings.