File Fragmentation in the Wild: A Privacy-Friendly Approach

Vincent van der Meer*, Hugo Jonker*, Guy Dols, Harm van Beek, Jeroen van den Bos, Marko van Eekelen

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference Article in proceedingAcademicpeer-review


Digital forensic tooling should be based on reference data. Such reference data can be gathered by measuring a baseline, e.g. from volunteers. However, the privacy provisions in digital forensics tools are typically tailored for criminal investigations. This is not sufficient to ensure privacy obligations towards volunteer participants. Thus, privacy adaptations are necessary before such tooling can be used to establish or rejuvenate a baseline.(p)(/p)We illustrate the feasibility of this approach by rejuvenating a baseline for file carving, via a case study of file fragmentation. We derive a set of privacy requirements to prevent deanonymisation of individuals. Atypical properties of files can nevertheless still lead to plausible deanonymisation of the file. With regards to fragmentation, we find out-of-order fragmentation, where a later block is stored on disk before an earlier block of the same file, occurs in nearly half of all fragmented files. This is the first study to report on prevalence of this type of fragmentation. Its high rate of occurrence has implications for the practice of file carving.
Original languageEnglish
Title of host publication2019 IEEE International Workshop on Information Forensics and Security (WIFS)
Subtitle of host publicationProceedings
Place of PublicationDelft
Number of pages6
ISBN (Electronic)9781728132174
ISBN (Print)9781728132181
Publication statusPublished - Dec 2019
Event2019 IEEE International Workshop on Information Forensics and Security - Mekelzalen (the Science Centre Delft), Delft, Netherlands
Duration: 9 Dec 201912 Dec 2019


Workshop2019 IEEE International Workshop on Information Forensics and Security
Abbreviated titleWIFS 2019
Internet address


Dive into the research topics of 'File Fragmentation in the Wild: A Privacy-Friendly Approach'. Together they form a unique fingerprint.

Cite this