一种基于内容特征的Word文件雕复方法

A WORD FILE CARVING METHOD BASED ON CONTENT CHARACTER

提出一种不依赖于文件系统元信息,而凭借于文件数据内容及其内部结构特征的Word文件雕复方法,其基本原理是利用文件头/根存储/最大扇区、分片文件的扇区分配表和分片文件的数据流等验证方法。此雕复方法能自动雕复在原始磁盘镜像中连续和分片有序存储的Word文件。实验结果表明该方法可以在Word文件自动雕复的高准确率情况下,确保低"误报"率。

This paper presents a Word File carving method based on file＇s content and the character of its internal structure but not depend on the metadata of file system.Its basic theory is to make use of header/root storage/max sector validation,SAT of the fragmented file validation and data stream of the fragment file validation.This carving method can carve automatically the contiguous Word files and the fragmented Word files stored in-order in original disc mirroring.Experiments show that the method can ensure lower ＂false positive＂ rate while the Word files are carved automatically with a high accuracy.