A Meta-Heuristic Method for Reassemble Bifragmented Intertwined JPEG Image Files in Digital Forensic Investigation

Abstract

Traditional image recovery from corrupted file systems plays a significant role in Digital Forensics investigation. The images are mainly considered objective court evidence. Since the JPEG image format is less structured than other image formats (e.g., BMP, PNG, GIF, and TIFF), its recovery is more challenging. The paper's main objective is to apply a metaheuristic optimization algorithm with similarity metric to recover Bifragmented intertwined JPEG images. We propose a new method known as Meta-Heuristic Reassemble Images (MHRI) for forensic recovery of Bifragmented intertwined JPEG images in the scan area, where all the fragments are in a linear order. The contribution of this paper lies in the following key components composing the MHRI method: (i) a Restart marker to remove some strange blocks from the scan area; (ii) a Coherence of Euclidean Distance metric (CoED m ) to detect the fragmentation point of intertwined JPEG image; and (iii) a Genetic Algorithm with cost function to predict if every two blocks are sequenced in the same image that searches for the best reassembly solution among the existing solutions. The MHRI method is implemented using MATLAB and tested using a combined dataset of 31 JPEG images. The MHRI process can fully recover all the Bifragmented intertwined JPEG images and 48.4% of all the JPEG images, which comparably performs better than similar methods. INDEX TERMSDigital forensic; JPEG image; image recovery, meta-heuristic, genetic algorithm; reassemble images; coherence of Euclidean distance; restart marker; DFRWS datasets.

A Comprehensive Analysis of the Role of Artificial Intelligence and Machine Learning in Modern Digital Forensics and Incident Response

“…The paper "A Meta-Heuristic Method for Reassembling Bifragmented Intertwined JPEG Image Files in Digital Forensic Investigation" by Ali et al (2023) presents a novel advancement in digital forensics with the introduction of the Meta-Heuristic Reassemble Images (MHRI) method, as seen in Fig. 16.…”