Detecting Disk Sectors Data Types Using Hidden Markov Model

File carving is process of recovering data without knowledge of file system like recovering files from a formatted disk. Sometime the file systems do not write a file to disk in continues sectors and may split it to more than one chunks. Recovering of such a fragmented file can be difficult because if we found the first chunk of the file, the second chunk can be anywhere on disk. If the disk is large, the search process for finding the second chunk of file will be a time-consuming process. Data type classification help to classify disk sectors based on the type stored on them. Understanding the type of stored data on disk sectors, help to search for a specified file only on area of disk that more likely have the file type we want. In this article we propose an approach to create a hidden markov model that can help classifying disk sector based on their type and detect the point of disk that a fragmentation probably happened. The created hidden markov model classify sectors based on their entropy. The results show 52% of correct data type detection on disks with 512Bytes sector size.

I. Introduction

In digital forensics, one of the most important task is to examine evidence, like disk drives, to retrieve information from them. Disk and storage is important resource for information gathering, but large disk space require a long time to examine. Before starting to analyze the storage for extracting information, understanding the structure and type of stored files help to do a quick examine and data recovery, as we can reduce search space on disks.