D3-FCDC

Isolate
File Content Decompression Checking

Definition

Checking if compressed or encoded data sections can be successfully decompressed or decoded. Can follow with further analysis with semantic knowledge

How it works

Some file formats such as JPEGs include encoded or compressed sections. This technique verfies that those expected sections are present and can be properly decoded according to the spec.

Artifact Relationships

This defensive technique relates to specific digital artifacts.

enforces
filters
analyzes
File Content Decompression Checking
Content Policy
File
File Content Block Data

References

Reference - Carving Contiguous and Fragmented Files with Fast Object Validation Reference - Gathering Evidence: Model-Driven Software Engineering in Automated Digital Forensics