Roadmap for Forensic Tool Development for Orphaned File Fragment Carving

Digital forensic experts encounter a sequence of raw bytes (a fragment of a file) in the absence of both the remaining fragments of the file and file system metadata. A tool must be developed to interpret these orphaned fragments and to reveal any evidence of crime, if such evidence exists. In this paper, we present a roadmap for developing such a challenging tool. The tool development requires a group of computer science researchers and software developers. This paper aims to provide guidance to the team responsible for developing this tool. Two major problems are addressed by authors of this paper in the direction of developing orphaned file fragment carver tool. They are (a) Development of a tool for creating an emulating storage media for use in research lab environment to mimic suspected storage media in forensic labs. (b) Development of an orphaned file fragment carver for an uncompressed image data type. In this paper, we will present the outcomes of these tools and roadmap on how to extend the tools for creating a tool of orphaned file fragment carver as an end product which can be used in digital forensic labs.