Semester of Graduation

Spring 2026

Degree

Master of Science in Computer Science (MSCS)

Department

Department of Computer Science and Engineering

Document Type

Thesis

Abstract

A core component of filesystems includes an address table or other means of tracking metadata on where a given file resides within a disk image. This is crucial for regular operation of a computer, or disk analysis in digital forensics. When filesystem information is missing or corrupted, locating saved files on a disk becomes challenging. Whether the disk was accidentally wiped or intentionally tampered with, data still present on the disk, even while untracked, can possibly be recovered beyond what the filesystem registers. File carving in digital forensics is important for these scenarios when data recovery is necessary but address tables are unusable. They take dumps of disks with corrupt or unusable filesystems and use algorithms to recover files manually where they would otherwise not be locatable. Scalpel3 is an open-source file carving application that resolves this issue by processing disk images block-by-block just as a filesystem would, searching for potential file candidates (or fragments of them), and attempting recovery of these files. In this paper, we introduce new functionality to the Scalpel3 application that implements the recovery of Roshal Archive (RAR) files found within these image dumps. We explore the solutions surrounding both contiguous and bifragmented file recovery, and discuss edge-case mitigation alongside partial recovery of corrupt or extremely fragmented RAR archive files. Finally, we quantitatively analyze the effectiveness of these recovery efforts using simulated disk images that include files in various degrees of fragmentation.

Date

3-20-2026

Committee Chair

Golden G. Richard III

LSU Acknowledgement

1

LSU Accessibility Acknowledgment

1

Download

Share

COinS