Improved file-Carving through data-parallel pattern matching for data forensics

Abstract

File-carving, as part of the data recovery process, is a topic of great interest due to its potential to minimize cost- impact in business environments, where the losses are significant every year, according to public reports. Starting with a modified version of the signature database of TrID, a long-established file-identification utility, and implementing a multiple-pattern matching algorithm that extends the Aho-Corasick automaton, we propose an approach suitable for multi-core systems for performing carving using complex patterns, that describe filetypes more accurately, making it also suitable for digital forensics. The experimental results have shown that our approach performs better and identifies data with greater accuracy, with lower than 3% performance degradation in the processing bandwidth of the original approach.