Semester of Graduation

Spring 2026

Degree

Master of Science (MS)

Department

Computer Science and Engineering

Document Type

Thesis

Abstract

File carving is a fundamental technique in the digital forensics community, enabling analysts to recover deleted files from disk images without relying on filesystem metadata; however, as storage capacities continue to increase, modern file carving tools face significant scalability challenges, with carving time growing substantially alongside disk image size, particularly in the presence of file fragmentation. Fragmentation, a common behavior in modern filesystems, distributes file data across non-contiguous disk blocks to maximize space utilization, and in large disk images this distribution can span wide logical distances, increasing the search space and reducing carving efficiency, causing traditional approaches to struggle within practical time constraints. This thesis addresses these limitations through the introduction of HPCScalpel3, an extension of the Scalpel 3 file carving framework, which partitions disk image block maps into smaller segments processed in parallel by independent instances of Scalpel 3, after which partially reconstructed outputs are recombined and subjected to an additional carving pass to recover cross-boundary fragmented files. In addition to presenting this parallelization framework, the work also investigates various disk image windowing techniques aimed at improving scalability, minimizing fragmentation-induced recovery overhead, and reducing total carving time.

Date

5-26-2026

Committee Chair

Kaiser, Hartmut

LSU Acknowledgement

1

LSU Accessibility Acknowledgment

1

Download

Included in

Cybersecurity Commons

Share

COinS