Cluster size determination using JPEG files

Authors:
Nurul Azma Abdullah;Rosziati Ibrahim;Kamaruddin Malik Mohamad
Affiliations:
Faculty of Computer Science and Information Technology, Universiti Tun Hussein Onn Malaysia, Johor, Malaysia;Faculty of Computer Science and Information Technology, Universiti Tun Hussein Onn Malaysia, Johor, Malaysia;Faculty of Computer Science and Information Technology, Universiti Tun Hussein Onn Malaysia, Johor, Malaysia
Venue:
ICCSA'12 Proceedings of the 12th international conference on Computational Science and Its Applications - Volume Part IV
Year:
2012

Citing 5
Cited 0

A fast file system for UNIX

ACM Transactions on Computer Systems (TOCS)
Advances in Disk Technology: Performance Issues

Computer
Single-byte-marker for Detecting JPEG JFIF Header Using FORIMAGE-JPEG

NCM '09 Proceedings of the 2009 Fifth International Joint Conference on INC, IMS and IDC
Fragmentation Point Detection of JPEG Images at DHT Using Validator

FGIT '09 Proceedings of the 1st International Conference on Future Generation Information Technology
Advanced carving techniques

Digital Investigation: The International Journal of Digital Forensics & Incident Response

Quantified Score

Hi-index	0.00

Visualization

Abstract

File can be recovered by simply using traditional recovery means. However, a technique is required to distinguish one file to another when dealing with hard disk with corrupted filesystem metadata. As in a computer file system, a cluster is the smallest allocation of disk space to hold a file, information about the cluster size can help in determining the start of file which can be used to distinguish one file to another. This paper introduces a method for acquiring the cluster size by using data sets from DFRWS 2006 and DFRWS 2007. A tool called PredClus is developed to automatically display the predicted cluster size according to probabilistic percentage. By using PredClus, the cluster size used in both DFRWS 2006 and DFRWS 2007 can be determined. Thus, JPEG images that are not located at the starting address of any cluster are most probably thumbnails or embedded files.