A Microsoft Word Documents Carving Method Base on Interior Virtual Streams

Microsoft word is widely used for word processing and document production. So the loss of the Word file would be great damages for their owner. File carving can reconstruct files based on their content and their own structure rather than using the metadata of the file system. The existing methods do not work very well on carving fragmented Word files. This paper presents a Microsoft Word documents carving method based on interior virtual streams. Firstly, we locate the header section and control streams-SAT to construct the framework for a Word file; then find its fragment regions by utilizing the framework information, and use the sequential hypothesis testing on the data streams in the fragment region to detect the fragment point. Based on DFRWS data sets and real data set, experiments show our method can automatically carve continuous and fragmented Microsoft word file. Moreover, the comparative experiments demonstrate that the proposed method is better than others' in accurateness and effectiveness.