Teaching Data Carving Using The Real World Problem of Text Message Extraction From Unstructured Mobile Device Data Dumps

Abstract

Data carving is a technique used in data recovery to isolate and extract files based on file content without any file system guidance. It is an important part of data recovery and digital forensics. However, it is also useful in teaching computer science students about file structure and the binary encoding of information, especially within a digital forensics program. This work demonstrates how the authors teach data carving using a real-world problem they encounter in digital forensics evidence processing involving the extracting of text messages from unstructured small device binary extractions. The authors have used this problem for instruction in digital forensics courses and other computer science courses.