Advanced JPEG carving

Authors:
Michael I. Cohen
Affiliations:
Australian Federal Police, Brisbane, Australia
Venue:
Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop
Year:
2008

Citing 3
Cited 2

File System Forensic Analysis

File System Forensic Analysis
Carving contiguous and fragmented files with fast object validation

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Advanced carving techniques

Digital Investigation: The International Journal of Digital Forensics & Incident Response

Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Image content analysis for sector-wise JPEG fragment classification

Journal of Visual Communication and Image Representation

Quantified Score

Hi-index	0.00

Visualization

Abstract

Data carving is a digital forensic technique which aims to reconstitute a file from unstructured data sources with no knowledge of the previously stored file system. This paper presents an approach for the carving of JPEG files. Since JPEG is one of the most popular image formats in the storage and distribution of digital photographic imagery it is frequently of great interest for certain types of forensic investigations. We apply the previously developed carving theory to the JPEG image format and develop an accurate, fully automated carver. We present a novel technique for the suspension and resumption of the decoder, making it possible to carve JPEG images in an acceptable time.