Automated reassembly of file fragmented images using greedy algorithms

Nasir Memon, Anandabrata Pal

Research output: Contribution to journalArticle

Abstract

The problem of restoring deleted files from a scattered set of fragments arises often in digital forensics. File fragmentation is a regular occurrence in hard disks, memory cards, and other storage media. As a result, a forensic analyst examining a disk may encounter many fragments of deleted digital files, but is unable to determine the proper sequence of fragments to rebuild the files. In this paper, we investigate the specific case where digital images are heavily fragmented and there is no file table information by which a forensic analyst can ascertain the correct fragment order to reconstruct each image. The image reassembly problem is formulated as a κ-vertex disjoint graph problem and reassembly is then done by finding an optimal ordering of fragments. We provide techniques for comparing fragments and describe several algorithms for image reconstruction based on greedy heuristics. Finally, we provide experimental results showing that images can be reconstructed with high accuracy even when there are thousands of fragments and multiple images involved.

Original languageEnglish (US)
Pages (from-to)385-393
Number of pages9
JournalIEEE Transactions on Image Processing
Volume15
Issue number2
DOIs
StatePublished - Feb 2006

Fingerprint

Hard disk storage
Greedy Algorithm
Image reconstruction
Fragment
Data storage equipment
Digital Forensics
Greedy Heuristics
Image Reconstruction
Digital forensics
Fragmentation
Digital Image
Table
Disjoint
High Accuracy
Experimental Results
Graph in graph theory
Vertex of a graph

Keywords

  • File fragmentation
  • Forensics
  • Greedy algorithms
  • Reassembly

ASJC Scopus subject areas

  • Computational Theory and Mathematics
  • Computer Graphics and Computer-Aided Design
  • Computer Vision and Pattern Recognition
  • Software
  • Electrical and Electronic Engineering
  • Theoretical Computer Science

Cite this

Automated reassembly of file fragmented images using greedy algorithms. / Memon, Nasir; Pal, Anandabrata.

In: IEEE Transactions on Image Processing, Vol. 15, No. 2, 02.2006, p. 385-393.

Research output: Contribution to journalArticle

@article{b6c94eeca38f4c998c08789d3f02169c,
title = "Automated reassembly of file fragmented images using greedy algorithms",
abstract = "The problem of restoring deleted files from a scattered set of fragments arises often in digital forensics. File fragmentation is a regular occurrence in hard disks, memory cards, and other storage media. As a result, a forensic analyst examining a disk may encounter many fragments of deleted digital files, but is unable to determine the proper sequence of fragments to rebuild the files. In this paper, we investigate the specific case where digital images are heavily fragmented and there is no file table information by which a forensic analyst can ascertain the correct fragment order to reconstruct each image. The image reassembly problem is formulated as a κ-vertex disjoint graph problem and reassembly is then done by finding an optimal ordering of fragments. We provide techniques for comparing fragments and describe several algorithms for image reconstruction based on greedy heuristics. Finally, we provide experimental results showing that images can be reconstructed with high accuracy even when there are thousands of fragments and multiple images involved.",
keywords = "File fragmentation, Forensics, Greedy algorithms, Reassembly",
author = "Nasir Memon and Anandabrata Pal",
year = "2006",
month = "2",
doi = "10.1109/TIP.2005.863054",
language = "English (US)",
volume = "15",
pages = "385--393",
journal = "IEEE Transactions on Image Processing",
issn = "1057-7149",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
number = "2",

}

TY - JOUR

T1 - Automated reassembly of file fragmented images using greedy algorithms

AU - Memon, Nasir

AU - Pal, Anandabrata

PY - 2006/2

Y1 - 2006/2

N2 - The problem of restoring deleted files from a scattered set of fragments arises often in digital forensics. File fragmentation is a regular occurrence in hard disks, memory cards, and other storage media. As a result, a forensic analyst examining a disk may encounter many fragments of deleted digital files, but is unable to determine the proper sequence of fragments to rebuild the files. In this paper, we investigate the specific case where digital images are heavily fragmented and there is no file table information by which a forensic analyst can ascertain the correct fragment order to reconstruct each image. The image reassembly problem is formulated as a κ-vertex disjoint graph problem and reassembly is then done by finding an optimal ordering of fragments. We provide techniques for comparing fragments and describe several algorithms for image reconstruction based on greedy heuristics. Finally, we provide experimental results showing that images can be reconstructed with high accuracy even when there are thousands of fragments and multiple images involved.

AB - The problem of restoring deleted files from a scattered set of fragments arises often in digital forensics. File fragmentation is a regular occurrence in hard disks, memory cards, and other storage media. As a result, a forensic analyst examining a disk may encounter many fragments of deleted digital files, but is unable to determine the proper sequence of fragments to rebuild the files. In this paper, we investigate the specific case where digital images are heavily fragmented and there is no file table information by which a forensic analyst can ascertain the correct fragment order to reconstruct each image. The image reassembly problem is formulated as a κ-vertex disjoint graph problem and reassembly is then done by finding an optimal ordering of fragments. We provide techniques for comparing fragments and describe several algorithms for image reconstruction based on greedy heuristics. Finally, we provide experimental results showing that images can be reconstructed with high accuracy even when there are thousands of fragments and multiple images involved.

KW - File fragmentation

KW - Forensics

KW - Greedy algorithms

KW - Reassembly

UR - http://www.scopus.com/inward/record.url?scp=31144464783&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=31144464783&partnerID=8YFLogxK

U2 - 10.1109/TIP.2005.863054

DO - 10.1109/TIP.2005.863054

M3 - Article

C2 - 16479808

AN - SCOPUS:31144464783

VL - 15

SP - 385

EP - 393

JO - IEEE Transactions on Image Processing

JF - IEEE Transactions on Image Processing

SN - 1057-7149

IS - 2

ER -