A novel file system that facilitates improved Digital Forensics and generalized solution to fragmented file recovery

Abstract

Reassembly of file fragments in the absence of file table information is a challenging problem in Digital Forensics and File Recovery. In literature we find file type specific solutions to this problem. In this paper we investigate a generalized solution that can be applied to every type of file. We present a technique to reassemble any type of fragmented file without using file table information. We have also presented time and space complexities of the algorithms in O-notation. In this technique each file on the disk is a Doubly Linked List with clusters as its nodes. We indicate some sections of Operating System that needs to be modified.