A Method of Office Data Fragmentation Recognition, Sorting, Reorganization and Repair

doi:10.3969/j.issn.1671-1122.2019.09.006

Abstract

Abstract:

Restoring deleted office documents is of great significance to the investigation and evidence collection. When the deleted office file data is stored on disk in multiple segments and MFT records are overwritten, the existing data recovery tools can not effectively recover the deleted data. In order to solve this problem, this paper proposes a method of office data fragmentation recognition, sorting, reorganization and repair. According to the data in the catalog area at the end of the Office file, locate all data fragments, determine the order of fragmentation, reorganize the Office file, and repair the damaged data fragments. Practice has proved that the method proposed in this paper can effectively restore the version of Office documents above 2007.

Key words: Office data fragmentation, recognition, sorting, reorganization, repair

CLC Number:

TP309

Guotian XU. A Method of Office Data Fragmentation Recognition, Sorting, Reorganization and Repair[J]. Netinfo Security, 2019, 19(9): 26-30.

Figures/Tables 2

References 16

[1]	DICKEMAN D. Advanced Data Carving[EB/OL]. The DFRW 2006 Data Caving Challege, , 2007-7-15.
[2]	WEI Yingjie.Archive File Carving Research[D]. Hangzhou: Hangzhou Dianzi University, 2011.
	卫英杰. 归档文件雕复研究[D].杭州:杭州电子科技大学,2011.
[3]	Wikipedia. Kolmogorov Complexity[EB/OL]. , 2008-10-15.
[4]	MO Chen, NING Zheng, MING Xu, et al. Validation Algorithms Based on Content Characters and Internalstructure: the PDF File carving method[EB/OL]. , 2018-7-15.
[5]	GARFINKEL S. CarvingContiguous and Fragmented Files with Fast Object Validation[EB/OL]. , 2018-7-15.
[6]	DONG Shule.On the Design and Research of JPEG Document Carving Technology[D]. Hangzhou: Hangzhou Dianzi University, 2009.
	董书乐. 试论JPEG文件雕复技术的设计与研究[D].杭州:杭州电子科技大学,2009.
[7]	LIN Wei.Research on Word File Carving Technology[D]. Hangzhou: Hangzhou Dianzi University, 2009.
	林蔚. Word文件雕复技术研究[D].杭州:杭州电子科技大学,2009.
[8]	CHEN Mo.A Method of Word File Carving Based on Content Feature[J]. Computer Applications and Software, 2010, 27(1): 100-102, 126.
	陈默. 一种基于内容特征的Word文件雕复方法[J].计算机应用与软件,2010,27(1):100-102,126.
[9]	ZHANG Wu.Research on Text Content Recovery Technology for Damaged or Fragmented Ooxml Documents[D]. Hangzhou: Hangzhou Dianzi University, 2014.
	张武. 损坏或分片Ooxml文档的文本内容恢复技术研究[D].杭州:杭州电子科技大学,2014.
[10]	SCOTT Hand, LIN Zhiqiang, GU Guofei. Bin-Carver: Automatic Recovery of Binary Executable Files[EB/OL]. , 2018-7-15.
[11]	PARK B, PARK J, LEE S. Data Concealment and Detection in Microsoft Office 2007 Files[EB/OL]. , 2018-7-15.
[12]	KORNBLUM J. Identifying Almost Identical Files Using Context Triggered Piecewise Hashing[EB/OL]. , 2018-7-15.
[13]	GARFINKEL S L, MCCARRIN M. Hash-based Carving: Searching Media for Complete Files and File Fragments with Sector Hashing and Hashdb[EB/OL]. , 2018-7-15.
[14]	JEONG D, LEE S. Study on the Tracking Revision History of MS Word Files for Forensic Investigation[EB/OL]. , 2018-7-15.
[15]	BREITINGER F, KANG H, LEE S. Towards Syntactic Approximate Matching-a pre-processing Experiment[EB/OL]. , 2018-7-15.
[16]	HALVANI O, WINTER C, PFLUG A. Authorship Verification for Different Languages, Genres and Topics[EB/OL]., 2018-7-15.