by Jungheum Park

frag_insight is a tool for fragmented data forensics.

Supported platforms

• Windows (VS 2010 project, written in C++ and MFC)

Clone the git repo https://github.com/jungheum/fragmented-data-forensics.git or download it

Execute frag_insight to analyze an image file

frag_insight  'target image'  'pagesize'  'output path'

Examples of usage

frag_insight  c:\\image1.dd   2048   c:\\output1
frag_insight  imageUnlloca    4096   outputPath

• Flash memory image (fragmented pages)
• Unallocated area of file system

• Page classification

  • hash-based classification (deduplication)
  • meta page classification
    • it supports the YAFFS and EXT4 file system
  • statistical classification
  • file format classification
    • it supports file formats such as SQLite, XML, HTML, TEXT, etc.

• Page analysis

  • format-based data analysis
    • this tool analyzes SQLite header / record

DFRC@KU

Please submit feedback via the frag_insight tracker

Author: Jungheum Park ([email protected])