Bin-Carver: Automatic recovery of binary executable files

作     者：Hand, Scott Lin, Zhiqiang Gu, Guofei Thuraisingham, Bhavani 

作者机构：Univ Texas Dallas Dept Comp Sci Dallas TX 75230 USA Univ Texas Dallas Erik Jonsson Sch Engn & Comp Sci Dallas TX 75230 USA Texas A&M Univ Dept Comp Sci & Engn College Stn TX 77843 USA 

出 版 物：《DIGITAL INVESTIGATION》 

年 卷 期：2012年第9卷

页      面：S108-S117页

核心收录：

学科分类：12[管理学] 1204[管理学-公共管理] 120401[管理学-行政管理] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

基　　金：Air Force Office of Scientific Research (AFOSR) [FA-9550-08-1-0260] 

主　　题：File carving ELF Fragmentation Digital forensics File recovery Binary code analysis 

摘      要：File carving is the process of reassembling files from disk fragments based on the file content in the absence of file system metadata. By leveraging both file header and footer pairs, traditional file carving mainly focuses on document and image files such as PDF and JPEG. With the vast amount of malware code appearing in the wild daily, recovery of binary executable files becomes an important problem, especially for the case in which malware deletes itself after compromising a computer. However, unlike image files that usually have both a header and footer pair, executable files only have header information, which makes the carving much harder. In this paper, we present Bin-Carver, a first-of-its-kind system to automatically recover executable files with deleted or corrupted metadata. The key idea is to explore the road map information defined in executable file headers and the explicit control flow paths present in the binary code. Our experiment with thousands of binary code files has shown our Bin-Carver to be incredibly accurate, with an identification rate of 96.3% and recovery rate of 93.1% on average when handling file systems ranging from pristine to chaotic and highly fragmented. (c) 2012 Z. Lin, S. Hand, G. Gu & B. Thuraisingham. Published by Elsevier Ltd. All rights reserved.