Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Fragment Retention Characteristics in Slack Space: Analysis and Measurements
Karlstad University, Faculty of Economic Sciences, Communication and IT, Department of Computer Science. Karlstad University, Faculty of Economic Sciences, Communication and IT, Centre for HumanIT.
Karlstad University, Faculty of Economic Sciences, Communication and IT, Department of Computer Science. Karlstad University, Faculty of Economic Sciences, Communication and IT, Centre for HumanIT.
2010 (English)In: Proceedings Security and Communication Networks (IWSCN), 2010 2nd International Workshop on  Security and Communication Networks, IEEE Computer Society, 2010Conference paper, Published paper (Refereed)
Abstract [en]

When files are deleted, their information is not removed from the storage media. This is a well known fact, and there exist numerous undelete utilities to recover newly deleted files. When deleted files have been partly overwritten, the data from the part of the file that remains in unallocated space can be readily extracted by file carving. Such carving is often performed in forensic investigations. Furthermore, as a consequence of file system implementation specifics, there additionally exist small remains of the previous files in the space at the end of new files. In this paper we focus on these small remains of previous files, or micro-fragments, that exist even after all the space allocated to the previous file has been reallocated to new files. We derive expressions for modeling the number of micro-fragments that can be expected to be found, and perform experiments to evaluate the analytical model. The obtained results indicate good correspondence between the analytical predictions and the measured results.

Place, publisher, year, edition, pages
IEEE Computer Society, 2010.
Keyword [en]
Computer Foresics, Fragment detection
National Category
Computer Science
Research subject
Computer Science
Identifiers
URN: urn:nbn:se:kau:diva-9811DOI: 10.1109/IWSCN.2010.5497996ISBN: 978-1-4244-6938-3 (print)ISBN: 978-1-4244-6939-0 (print)OAI: oai:DiVA.org:kau-9811DiVA: diva2:493318
Conference
2nd International Workshop on Security and Communucation Networks Karlstad 26-28 May 2010
Available from: 2012-02-08 Created: 2012-02-08 Last updated: 2013-10-23Bibliographically approved

Open Access in DiVA

No full text

Other links

Publisher's full text

Search in DiVA

By author/editor
Holleboom, Thijs JanGarcia, Johan
By organisation
Department of Computer ScienceCentre for HumanIT
Computer Science

Search outside of DiVA

GoogleGoogle Scholar

Altmetric score

Total: 331 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf