Making Sense of Unstructured Flash-Memory Dumps

摘要

This paper presents an alternative to traditional file carving, targeted to flash-memory based devices. The proposed algorithm processes the flash memory dump thanks to a previous partial knowledge of the content of the regular files present in the device. The memory dump is decomposed into elementary parts, each part classified according to the file type it is supposed to belong to, and finally ordered in a sequence representing the recovered file. The sequence is then transformed into a real file. This paper presents the formal model behind the algorithm.