Word 2007文件雕复方法研究

目前在字处理领域中占有优势地位的Microsoft Word文件是一种重要的数字证据来源,因此开展针对Word文件雕复技术的研究是非常必要的。该文在研究Word 2007文件结构特点和内容特征的基础上,结合已有的雕复技术,提出了一个新的Word 2007文件雕复方法,该方法可以雕复二分片、非关键部位数据损坏或丢失的word 2007文件。在实际磁盘数据集上的对比实验表明该雕复算法与同类算法相比具有更好的准确性。研究成果期望为进一步发展文件雕复技术提供一种新的思路,也为实现更加实用的数据恢复系统打下基础。

Research of Word 2007 File Carving

Microsoft Word is in a dominant position in the market of the word -processing products. It be- comes one of the most important source to the digital forensics. Therefore, the study on carving technology for Word file is very important. This paper proposes a Word 2007 file carving algorithm. This method makes use of the structure and content characteristic of Word 2007 file and combines with the existing carving technology, presents the settlement of carving problem including local-bifragment in Word 2007 file and non-critical parts of Word 2007 file data damage or loss. In the paper, comparative experiments on real world data set show that the carving algorithm has superiority than other similar algorithms. In summary, the paper presents Word file carving algorithms and authenticity verifying method which have been proved the feasibility and effectiveness by the experiments. These research achievements not only provide new approach for file carving technology in further development, but also construct the foundation for implementing practical file carving system.