ScholarWorks@숙명여자대학교

초록

Signature-based file recovery can be effective even in environments where metadata is damaged; however, it often suffers from high false positive rates and format misclassification because it overlooks the internal structure of files. To resolve this issue, this paper introduces a structure-aware recovery technique that integrates structural consistency verification with sub-parsing. This method leverages format-specific internal structures to validate recovery candidates, accurately differentiates between OLE2 document formats that share identical headers, and facilitates HWP recovery, which has been unsupported by existing tools. Experimental results demonstrate that the recovery tool utilizing this technique reduces false positives by over 90% compared to Scalpel and eliminates misclassification of document families entirely. This paper highlights the potential of a new recovery framework that enhances the accuracy and reliability of signature-based file recovery through structural verification.

키워드