Data Reconstruction and Secure Erasure: Unleashing the Power of File Carving and Data Sanitation

No ratings

Presented at Texas Cyber Summit 2023 by

Mackenzie Zappe

NEEDED: Bring your own laptop. Format of Hexadecimal number system , file extensions This presentation delves into the concepts of file carving and data sanitation, exploring their significance in digital forensic investigations. The session begins with an introduction to file carving, explaining its definition and highlighting its role in forensic analysis. Special focus is given to header-footer carving techniques, which enables the recovery of fragmented files. Moving on, the topic shifts to data sanitation. Emphasis is placed on NIST 800-88, a prominent guideline governing data sanitation practices. Best practices for data sanitation are also discussed, providing attendees with valuable insights into ensuring data security.Following the presentation, participants are presented with the opportunity to engage in file carving activities as a hands-on challenge. The attendees can choose between an easy and a hard activity. The easy activity involves examining a document file and identifying 2-3 embedded images within it. In contrast, the hard activity entails reconstructing an incomplete file by determining its file type and adding the correct header/footer. Complicating matters further, the incomplete file contains multiple embedded files, necessitating careful carving to extract the correct information.This session aims to equip attendees with practical knowledge of file carving and data sanitation, offering a comprehensive understanding of their applications and challenges in the field of digital forensic investigations.