lecture 3

Question 1

what is the life cycle of a file

Answer 1

Creating files
Accessing files
Modifying files
Deleting files

Question 2

what are other functions of a file

Answer 2

Organisation – hierarchical folders
Managing free space
Avoiding corruption (journaling)
Security (Access Control Lists / ACLs / Wiping)
Availability / Resilience (RAID)
Efficiency (compression, defragging, Hierarchical Storage Systems)

Question 3

what is carving

Answer 3

Carving is the contiguous search for the start point and endpoint of a file (the magic numbers) across a whole storage device, or on only specific areas such as the unallocated clusters.

Magic numbers are the first few bytes of a file which are unique to a particular file type. These unique bits are referred to as magic numbers,also sometimes referred to as afile signature.

Question 4

what are the advantages of carving

Answer 4

Don’t need to understand the File System.
Can find ‘hidden’ files within other data structures (e.g. a picture within a word document).
You can search the whole disk or specific areas such as the unallocated areas of the disk.

Question 5

what are the disadvantages of carving

Answer 5

Can produce an extremely large number of results – can’t filter by metadata (date made, folder etc.)
False positives: If you have a bad signature then you are wasting time eliminating the false positives, rather than the real pictures.
Fragmented files!
Small files such as pictures may be incomplete/corrupted
Large files such as videos might appear to be spliced