Browse > Article
http://dx.doi.org/10.13089/JKIISC.2017.27.5.1107

A Method of Recovery for Damaged ZIP Files  

Jung, Byungjoon (Center for Information Security Technologies, Korea University)
Han, Jaehyeok (Center for Information Security Technologies, Korea University)
Lee, Sang-jin (Center for Information Security Technologies, Korea University)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.27, no.5, 2017 , pp. 1107-1115 More about this Journal
Abstract
The most commonly used PKZIP format is a ZIP file, as well as a file format used in MS Office files and application files for Android smartphones. PKZIP format files, which are widely used in various areas, require structural analysis from the viewpoint of digital forensics and should be able to recover when files are damaged. However, previous studies have focused only on recovering data or extracting meaningful data using the Deflate compression algorithm used in ZIP files. Although most of the data resides in compressed data in the ZIP file, there is also forensically meaningful data in the rest of the ZIP file, so you need to restore it to a normal ZIP file format. Therefore, this paper presents a technique to recover a damaged ZIP file to a normal ZIP file when given.
Keywords
PKZIP; ZIP; Deflate; Recovery;
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 PKWARE Inc, ZIP File Format Specifi cation[Internet], https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT Oct. 2014.
2 ECMA, Standard ECMA-376 Office Open XML File Formats[Internet], https://www.ecma-international.org/publications/standards/Ecma-376.htm, Dec. 2016.
3 Karl Wust, "Force Open: Lightweight black box file repair," Proceedings of the Fourth Annual DFRWS Europe, pp. 75-82, January. 2017.
4 Jean-loup Gailly and Mark Adler, Zlib[Internet], https://zlib.net/, January 2017.
5 Ralf D. Brown, "Improved recovery and reconstruction of DEFLATEd files," Digital Investigation, pp. 21-29, June. 2013.
6 Ralf D. Brown, "Reconstructing corrupt DEFLATEd files," Digital Investigation, pp. 125-131, May. 2011.
7 Bora Park, "Determinant Whether the Data Fragment in Unallocated Space is Compressed or Not and Decompressing of Compressed Data Fragment", Journal of the Korea Institute of Information Security & Cryptology, pp. 175-185, Aug. 2008.