主管：中华人民共和国司法部
主办：司法鉴定科学研究院
ISSN 1671-2072  CN 31-1863/N
中国司法鉴定

›› 2013 ›› Issue (3): 0-.

• 鉴定制度 •    下一篇

电子取证中AVI文件的文件雕复

  

  1. 北京信息科技大学
  • 出版日期:2013-05-15 发布日期:2013-06-04

Carving of AVI Files in Digital Forensics

  • Published:2013-05-15 Online:2013-06-04

被引次数

2

摘要： 用电子取证中的文件雕复相关技术，并以AVI文件为实例，阐述一种侦测AVI文件碎片，并将碎片排序组合成完整文件的文件雕复方法。通过实例的文件雕复方法基于AVI文件格式的结构特征，借鉴了文件结构关键字匹配，二分碎片间隙雕复等文件雕复思想来完成实验。此方法能在失去系统元信息的情况下完成对AVI文件的文件雕复。实验结果表明，此方法提高了有碎片的AVI文件的雕复成功率。

Abstract: The technology of file carving in digital forensics is introduced. A file carving method, which detects AVI file fragments, sorts and combines them into a complete file, is elaborated. This method is based on the structure of the AVI file, and adopts the keyword matching of file structure, bi-fragment gap carving and other file carving ideas to complete the process. This method can be used to complete the AVI file carving in the case of losing the metadata of the file system. The experimental results show that the carving rate of AVI files with fragments is improved by the method.