Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Retention of Micro-fragments in Cluster Slack: A First Model
Karlstad University, Faculty of Economic Sciences, Communication and IT, Department of Computer Science. Karlstad University, Faculty of Economic Sciences, Communication and IT, Centre for HumanIT.
Karlstad University, Faculty of Economic Sciences, Communication and IT, Department of Computer Science. Karlstad University, Faculty of Economic Sciences, Communication and IT, Centre for HumanIT.
2009 (English)In: First IEEE International Workshop on Information Forensics and Security (WIFS 2009), London, UK: IEEE Signal Processing Society, 2009, 31-35 p.Conference paper, (Refereed)
Abstract [en]

In current forensic practice it is regularly needed to determine whether some set of files have been present on a storage medium or not. File carving techniques are readily used as a tool in such examinations. However, if all clusters holding the files searched for have been overwritten, remains of the previous files only resides in the cluster slack. In this work we elaborate on the factors that influence how many such cluster slack ¿micro-fragments¿ that can be expected to be detected. We identify a set of factors that influence the micro-fragment retention characteristics. One such characteristic is the file size distribution of the files overwriting the original files. We derive analytical expressions for three different file size distributions, which allows us to examine the retention characteristics even if the overwriting files come from different sources.

Place, publisher, year, edition, pages
London, UK: IEEE Signal Processing Society, 2009. 31-35 p.
National Category
Computer Science
Research subject
Computer Science
Identifiers
URN: urn:nbn:se:kau:diva-11304DOI: 10.1109/WIFS.2009.5386487ISBN: 978-1-4244-5279-8 (print)ISBN: 978-1-4244-5280-4 (print)OAI: oai:DiVA.org:kau-11304DiVA: diva2:494878
Conference
IEEE Workshop on Information Forensics and Security (WIFS), 6-9 Dec. 2009
Available from: 2012-02-08 Created: 2012-02-08 Last updated: 2013-10-11Bibliographically approved

Open Access in DiVA

No full text

Other links

Publisher's full text

Search in DiVA

By author/editor
Garcia, JohanHolleboom, Thijs Jan
By organisation
Department of Computer ScienceCentre for HumanIT
Computer Science

Search outside of DiVA

GoogleGoogle Scholar

Altmetric score

Total: 324 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf