Skip to content

File Fragment Analysis Using Normalized Compression Distance

2Citations
Citations of this article
10Readers
Mendeley users who have this article in their library.

This artice is free to access.

Abstract

The first step when recovering deleted files using file carving is to identify the file type of a block, also called file fragment analysis. Several researchers have demonstrated the applicability of Kolmogorov complexity methods such as the normalized compression distance (NCD) to this problem. NCD methods compare the results of compressing a pair of data blocks with the compressed concatenation of the pair. One parameter that is required is the compression algorithm to be used. Prior research has identified the NCD compressor properties that yield good performance. However, no studies have focused on its applicability to file fragment analysis. This paper describes the results of experiments on a large corpus of files and file types with different block lengths. The experimental results demonstrate that, in the case of file fragment analysis, compressors with the desired properties do not perform statistically better than compressors with less computational complexity. © IFIP International Federation for Information Processing 2013.

Cite

CITATION STYLE

APA

Axelsson, S., Bajwa, K. A., & Srikanth, M. V. (2013). File Fragment Analysis Using Normalized Compression Distance. In IFIP Advances in Information and Communication Technology (Vol. 410, pp. 171–182). https://doi.org/10.1007/978-3-642-41148-9_12

Register to see more suggestions

Mendeley helps you to discover research relevant for your work.

Already have an account?

Save time finding and organizing research with Mendeley

Sign up for free