Identification and Recovery of JPEG Files with Missing Fragments
نویسندگان
چکیده
Recovery of fragmented files proves to be a challenging task for encoded files like JPEG. In this paper, we consider techniques for addressing two issues related to fragmented JPEG file recovery. First issue concerns more efficient identification of the next fragment of a file undergoing recovery. Second issue concerns the recovery of file fragments which cannot be linked to an existing image header or for which there is no available image header. Current file recovery approaches are not well suited to deal with these practical issues. In addressing these problems, we utilize JPEG file format specifications. More specifically, we propose a technique based on bit sequence matching to identify fragments created by the same Huffman code tables. We also address the construction of a pseudo header needed for recovery of stand-alone file fragments. Some experimental results are provided to support our claims. a 2009 Digital Forensic Research Workshop. Published by Elsevier Ltd. All rights reserved.
منابع مشابه
Bin-Carver: Automatic recovery of binary executable files
File carving is the process of reassembling files from disk fragments based on the file content in the absence of file system metadata. By leveraging both file header and footer pairs, traditional file carving mainly focuses on document and image files such as PDF and JPEG. With the vast amount of malware code appearing in the wild daily, recovery of binary executable files becomes an important...
متن کاملAN IMPROVED FILE CARVER OF INTERTWINED JPEG IMAGES USING X_myKarve
File carving is a common technique for retrieving evidence data from computers that have been used for crime activities to assist crimes investigations especially in solving pornography cases where traditional data recovery fail. However, carving fragmented JPEG files are not easy to solve due to the complexity of determining the fragmentation point. In this research, X_myKarve’s framework is i...
متن کاملA Sector-wise Jpeg Data Fragment Classification Method Based on Image Content Analysis
In this paper, we propose a sector-wise JPEG fragment point classification approach to classify normal and erroneous JPEG data fragments with the minimum size of 512 Bytes per fragment. The contributions of this work are two-folds: 1) a sectorwise JPEG erroneous fragment classification approach is proposed 2) a new DCT coefficient analysis method is introduced for the JPEG image content analysi...
متن کاملNon-Contiguous JPEG File Carver
Many studies have been conducted in addressing problem of fragmented JPEG. However, carving fragmented JPEG files are not easy to solve due to the complexity of determining the fragmentation point. In this article, X_myKarvee framework is introduced to address the fragmentation issues that occur in JPEG images. X_myKarve introduce a new technique, deletion by binary search to detect fragmentati...
متن کاملCarving Contiguous and Fragmented Files with Object Validation
‘‘File carving’’ reconstructs files based on their content, rather than using metadata that points to the content. Carving is widely used for forensics and data recovery, but no file carvers can automatically reassemble fragmented files. We survey files from more than 300 hard drives acquired on the secondary market and show that the ability to reassemble fragmented files is an important requir...
متن کامل