Facsimile File Recovery of Copier Based on Single Element String Feature

• 1、School of cyberspace security,Beijing University of Posts and Telecommunications,Beijing 100876
• 2、School of cyberspace security,Beijing University of Posts and Telecommunications, Beijing 100876

Abstract：As countries and private enterprises pay more attention to information security，regular security checks on fixed assets have become a standard task. As an important office equipment, the copier stores a large amount of data information in its hard disk, so it is listed as the key object of security check. However, due to the lack of understanding of the organizational structure of the file system, the computer security checking tools used in PC terminals can not complete the adaptation migration to the copier.In addition, fax formats widely used by copiers for storing documents lack the obvious magic number characteristics, and the general data recovery software can not be applied to the inspection task. In order to solve this practical problem, the text analyzes the hexadecimal content of the facsimile format file, and proposes a new strategy based on the single element string feature.Through the analysis of the data and the comparison with the existing inspection tools, it is proved that the scheme can locate and extract the content of the fax files from the mass hard disk data, and maintain a higher accuracy rate.

Keywords： computer forensics confidential inspection copier storage system file carving