File Download
  Links for fulltext
     (May Require Subscription)
Supplementary

Conference Paper: Recovery of heavily fragmented JPEG files

TitleRecovery of heavily fragmented JPEG files
Authors
Issue Date2016
PublisherElsevier Ltd.
Citation
The 16th Annual Digital Forensics Research Conference (DFRWS 2016), Seattle, WA., 7-10 August 2016. In Digital Investigation, 2016, v. 18 suppl., p. S108-S117 How to Cite?
AbstractFile carving from damaged file system plays an important role in file recovery for identifying evidence in digital forensics. In this paper, we focus on JPEG file carving, with an emphasis on heavily fragmented cases. The difficulty lies on how to order fragmented pieces into a complete picture without sufficient decoding information. We provide a framework to tackle this problem, which consists of the following key components: (i) a new similarity metric (CED) to evaluate if two data blocks are consecutive in the same JPEG file and a fragmentation point detection algorithm based on CED; and (ii) an overall recovery algorithm to reconstruct the JPEG file from fragmented pieces. The proposed framework was verified on an image dump from a SD card of a digital camera. The results were compared to Adroit Photo Forensic (APF), a commonly used photo carving tool. In our experiments, our tool can automatically recover 97% fragmented JPEG files (versus 79% by APF). © 2016 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).
DescriptionSession 4: Data Recovery
This journal suppl. entitled: DFRWS USA 2016 - Proceedings of the 16th Annual USA Digital Forensics Research Conference
Persistent Identifierhttp://hdl.handle.net/10722/237680
ISI Accession Number ID

 

DC FieldValueLanguage
dc.contributor.authorTang, Y-
dc.contributor.authorFang, JB-
dc.contributor.authorChow, KP-
dc.contributor.authorYiu, SM-
dc.contributor.authorXu, J-
dc.contributor.authorFeng, B-
dc.contributor.authorLi, Q-
dc.contributor.authorHan, Q-
dc.date.accessioned2017-01-19T01:07:26Z-
dc.date.available2017-01-19T01:07:26Z-
dc.date.issued2016-
dc.identifier.citationThe 16th Annual Digital Forensics Research Conference (DFRWS 2016), Seattle, WA., 7-10 August 2016. In Digital Investigation, 2016, v. 18 suppl., p. S108-S117-
dc.identifier.urihttp://hdl.handle.net/10722/237680-
dc.descriptionSession 4: Data Recovery-
dc.descriptionThis journal suppl. entitled: DFRWS USA 2016 - Proceedings of the 16th Annual USA Digital Forensics Research Conference-
dc.description.abstractFile carving from damaged file system plays an important role in file recovery for identifying evidence in digital forensics. In this paper, we focus on JPEG file carving, with an emphasis on heavily fragmented cases. The difficulty lies on how to order fragmented pieces into a complete picture without sufficient decoding information. We provide a framework to tackle this problem, which consists of the following key components: (i) a new similarity metric (CED) to evaluate if two data blocks are consecutive in the same JPEG file and a fragmentation point detection algorithm based on CED; and (ii) an overall recovery algorithm to reconstruct the JPEG file from fragmented pieces. The proposed framework was verified on an image dump from a SD card of a digital camera. The results were compared to Adroit Photo Forensic (APF), a commonly used photo carving tool. In our experiments, our tool can automatically recover 97% fragmented JPEG files (versus 79% by APF). © 2016 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).-
dc.languageeng-
dc.publisherElsevier Ltd.-
dc.relation.ispartofDigital Investigation-
dc.rights© 2016. This manuscript version is made available under the CC-BY-NC-ND 4.0 license http://creativecommons.org/licenses/by-nc-nd/4.0/-
dc.titleRecovery of heavily fragmented JPEG files-
dc.typeConference_Paper-
dc.identifier.emailChow, KP: chow@cs.hku.hk-
dc.identifier.emailYiu, SM: smyiu@cs.hku.hk-
dc.identifier.authorityChow, KP=rp00111-
dc.identifier.authorityYiu, SM=rp00207-
dc.description.naturelink_to_OA_fulltext-
dc.identifier.doi10.1016/j.diin.2016.04.016-
dc.identifier.hkuros271060-
dc.identifier.volume18-
dc.identifier.issuesuppl.-
dc.identifier.spageS108-
dc.identifier.epageS117-
dc.identifier.isiWOS:000380900500012-
dc.publisher.placeUnited States-
dc.customcontrol.immutablesml 170119-

Export via OAI-PMH Interface in XML Formats


OR


Export to Other Non-XML Formats