The 7th Annual DFRWS Conference was held from August 13 to 15, 2007 at the Omni William Penn Hotel in Pittsburgh, PA with local assistance from the CERT Coordination Center. Keynote speakers included Greg Hoglund (author of ROOTKITS, Subverting the Windows Kernel) and Ronald van der Knijff (Netherlands Forensic Institute).  17 peer-reviewed papers were presented at the conference.

THE DFRWS 2007 CHALLENGE was about data carving, which is a file recovery technique that is frequently used during digital investigations. Files are “carved” from the unallocated space using file type-specific information, such as footers, headers, and internal structures.

The previous DFRWS 2006 Challenge focused on carving basic file types in basic scenarios. The result was the development of new tools and techniques to carve files using more internal structure than only the header and footer values. This year, DFRWS expanded on that challenge by introducing more file types and more complex fragmentation scenarios. The goal of this challenge was to design and develop automated file carving algorithms that have high true positive and low false positive rates.

Michael Cohen won the 2007 challenge for his work on a theory of fragmentation and file mapping, and developed dedicated validators for PDF, ZIP, MIME, HTML and MPEG. His process involved evaluating possible files against an ideal mapping model, performing interpolation when discontinuities were found, and then performing error checking on the resulting files using his validation utilities. Even though Cohen did not focus on image and office file formats, his results still ended up very high, with the lowest false positive score. The high quality of the results from this approach shows promise.