Identification and recovery of JPEG files with missing fragments

Husrev T. Sencar, Nasir Memon

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    Recovery of fragmented files proves to be a challenging task for encoded files like JPEG. In this paper, we consider techniques for addressing two issues related to fragmented JPEG file recovery. First issue concerns more efficient identification of the next fragment of a file undergoing recovery. Second issue concerns the recovery of file fragments which cannot be linked to an existing image header or for which there is no available image header. Current file recovery approaches are not well suited to deal with these practical issues. In addressing these problems, we utilize JPEG file format specifications. More specifically, we propose a technique based on bit sequence matching to identify fragments created by the same Huffman code tables. We also address the construction of a pseudo header needed for recovery of stand-alone file fragments. Some experimental results are provided to support our claims.

    Original languageEnglish (US)
    Title of host publicationDFRWS 2009 Annual Conference
    StatePublished - 2009
    Event9th Annual Digital Forensic Research Workshop, DFRWS 2009 - Montreal, QC, Canada
    Duration: Aug 17 2009Aug 19 2009

    Other

    Other9th Annual Digital Forensic Research Workshop, DFRWS 2009
    CountryCanada
    CityMontreal, QC
    Period8/17/098/19/09

    Fingerprint

    Recovery
    Specifications

    Keywords

    • File recovery
    • Fragmentation
    • Huffman code tables
    • JPEG/JFIF

    ASJC Scopus subject areas

    • Information Systems

    Cite this

    Sencar, H. T., & Memon, N. (2009). Identification and recovery of JPEG files with missing fragments. In DFRWS 2009 Annual Conference

    Identification and recovery of JPEG files with missing fragments. / Sencar, Husrev T.; Memon, Nasir.

    DFRWS 2009 Annual Conference. 2009.

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Sencar, HT & Memon, N 2009, Identification and recovery of JPEG files with missing fragments. in DFRWS 2009 Annual Conference. 9th Annual Digital Forensic Research Workshop, DFRWS 2009, Montreal, QC, Canada, 8/17/09.
    Sencar HT, Memon N. Identification and recovery of JPEG files with missing fragments. In DFRWS 2009 Annual Conference. 2009
    Sencar, Husrev T. ; Memon, Nasir. / Identification and recovery of JPEG files with missing fragments. DFRWS 2009 Annual Conference. 2009.
    @inproceedings{fc1e05aacebf4ab08887f2eca89117ad,
    title = "Identification and recovery of JPEG files with missing fragments",
    abstract = "Recovery of fragmented files proves to be a challenging task for encoded files like JPEG. In this paper, we consider techniques for addressing two issues related to fragmented JPEG file recovery. First issue concerns more efficient identification of the next fragment of a file undergoing recovery. Second issue concerns the recovery of file fragments which cannot be linked to an existing image header or for which there is no available image header. Current file recovery approaches are not well suited to deal with these practical issues. In addressing these problems, we utilize JPEG file format specifications. More specifically, we propose a technique based on bit sequence matching to identify fragments created by the same Huffman code tables. We also address the construction of a pseudo header needed for recovery of stand-alone file fragments. Some experimental results are provided to support our claims.",
    keywords = "File recovery, Fragmentation, Huffman code tables, JPEG/JFIF",
    author = "Sencar, {Husrev T.} and Nasir Memon",
    year = "2009",
    language = "English (US)",
    booktitle = "DFRWS 2009 Annual Conference",

    }

    TY - GEN

    T1 - Identification and recovery of JPEG files with missing fragments

    AU - Sencar, Husrev T.

    AU - Memon, Nasir

    PY - 2009

    Y1 - 2009

    N2 - Recovery of fragmented files proves to be a challenging task for encoded files like JPEG. In this paper, we consider techniques for addressing two issues related to fragmented JPEG file recovery. First issue concerns more efficient identification of the next fragment of a file undergoing recovery. Second issue concerns the recovery of file fragments which cannot be linked to an existing image header or for which there is no available image header. Current file recovery approaches are not well suited to deal with these practical issues. In addressing these problems, we utilize JPEG file format specifications. More specifically, we propose a technique based on bit sequence matching to identify fragments created by the same Huffman code tables. We also address the construction of a pseudo header needed for recovery of stand-alone file fragments. Some experimental results are provided to support our claims.

    AB - Recovery of fragmented files proves to be a challenging task for encoded files like JPEG. In this paper, we consider techniques for addressing two issues related to fragmented JPEG file recovery. First issue concerns more efficient identification of the next fragment of a file undergoing recovery. Second issue concerns the recovery of file fragments which cannot be linked to an existing image header or for which there is no available image header. Current file recovery approaches are not well suited to deal with these practical issues. In addressing these problems, we utilize JPEG file format specifications. More specifically, we propose a technique based on bit sequence matching to identify fragments created by the same Huffman code tables. We also address the construction of a pseudo header needed for recovery of stand-alone file fragments. Some experimental results are provided to support our claims.

    KW - File recovery

    KW - Fragmentation

    KW - Huffman code tables

    KW - JPEG/JFIF

    UR - http://www.scopus.com/inward/record.url?scp=84868534408&partnerID=8YFLogxK

    UR - http://www.scopus.com/inward/citedby.url?scp=84868534408&partnerID=8YFLogxK

    M3 - Conference contribution

    BT - DFRWS 2009 Annual Conference

    ER -