Carving Thumbnail/s and Embedded JPEG Files Using Image Pattern Matching

Abdullah, Nurul Azma; Ibrahim, Rosziati; Mohamad, Kamaruddin Malik

doi:10.4236/jsea.2013.63b014

Cited by 14 publications

(11 citation statements)

References 8 publications

(13 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…[4][5][6][7][8][9][10][11][12][13][14][15]17 The existing methods are mainly graph based, which consider fragments as vertexes and assign the probabilities that two fragments are adjacent to the costs/weights of the edges. The constructed graph is directed complete graph.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Reassembling fragmented BMP files based on padding bytes

Han

Niu

2016

J. Electron. Imaging

View full text Add to dashboard Cite

Reassembling fragmented image files plays a crucial role in seizing digital evidence from scattered digital image files. The existing algorithms are mainly graph based, which cast the reassembly problem as a K -vertex disjoint path problem in a directed complete graph, which is an NP-complete problem. Based on the padding bytes in BMP files, we present a method to exclude most impossible paths, which can improve the accuracy and decrease the time complexity of the existing graph-based methods. According to the alignment rule of BMP format, padding bytes must be appended to the end of each row to bring up the length of the row to a multiple of 4 bytes. Hence the fragment, being a vertex of the path which correctly reassembles a file, has a property; its byte values at padding positions must be the padding values. Only the fragments with such property can be candidate fragments for the vertex. On the test dataset which is constructed based on 330 image files, taking eight classical methods as examples, we show that the proposed method produces an accuracy improvement ranging from 32% to 55%, and reduces the run time to a scope from 1/6 to 1/237.

show abstract

Section: Introductionmentioning

confidence: 99%

“…Reassembling fragmented files [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15] is to reconstruct digital files from a collection of randomly mixed fragments of these files. It arises in digital forensics and plays a crucial role in seizing digital evidence from scattered digital files.…”

Section: Introductionmentioning

confidence: 99%

Reassembling fragmented BMP files based on padding bytes

Han

Niu

2016

J. Electron. Imaging

View full text Add to dashboard Cite

show abstract

“…File carving [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16] is a forensic technique that recovers digital files based merely on file structure and content without any file system metadata. The digital files such as word processing files, video files, and image files increasingly provide the forensic investigators with important (and sometimes essential) evidence in criminal cases [17].…”

Section: Introductionmentioning

confidence: 99%

“…The digital image file is one of the most commonly used digital file types. Moreover, because JPEG files are the most widely adopted image format and the default format used by the majority of digital cameras and smartphones, the carving of them [5–11, 14, 16] has attracted researchers’ great attention.…”

Section: Introductionmentioning

confidence: 99%

JPEG image width estimation for file carving

Han

Niu

et al. 2018

IET image process

View full text Add to dashboard Cite

Image width is an important factor for making the partially recovered data perceptually meaningful in image file carving. The authors conduct a comprehensive comparison of the performance of the representative methods for estimating the JPEG image width. Experimental results show that the best methods based on pixels are always better than the best methods based on quantised discrete cosine transform (DCT) coefficients. To keep the good performance of the pixel-based methods when the correct quantisation tables are unavailable, the authors replace the correct quantisation tables with the standard ones. Experimental results certify that such a replacement has only a little effect on the performance of the pixel-based methods, the best of which still outperform the best methods based on quantised DCT coefficients. The two results indicate that it may be enough to just focus on the pixel-based methods for future work. Finally, they propose a pixel-based method, which derives the candidate image widths from the most likely adjacent minimum coded unit (MCU) pairs in the vertical direction. The candidate width which appears most frequently is chosen as the estimated image width. Experimental results show that the proposed method usually has the best performance when most MCUs of an image are recovered.

show abstract

“…A thumbnail in JFIF and Exif format can be recognized using UHP as described in [23]. The algorithm of PattrecCarv is introduced (illustrated in Figure. First, data from dataset is read.…”

Section: A Pattreccarvmentioning

confidence: 99%

Reducing Falsely Detected JPEG’s Fragmentation Point Using Unique Hex Patterns (UHP)

Azma

Ibrahim²,

Malik³

et al. 2013

Proceedings of the 2nd International Conference on Advances in Computer Science and Engineering

View full text Add to dashboard Cite

Abstract-To increase number of evidence obtained in an effort to fight cyber perpetrator, many studies have been conducted in addressing problem of fragmented JPEG images. However, thumbnail/s is/are always been mistaken as fragmentation point of fragmented JPEG images. This paper discusses on how thumbnail can be used to reduce false detection. The main contribution of this paper is introducing patterns to distinguish the header of original JPEG images with thumbnail/s.

show abstract

Carving Thumbnail/s and Embedded JPEG Files Using Image Pattern Matching

Cited by 14 publications

References 8 publications

Reassembling fragmented BMP files based on padding bytes

Reassembling fragmented BMP files based on padding bytes

JPEG image width estimation for file carving

Reducing Falsely Detected JPEG’s Fragmentation Point Using Unique Hex Patterns (UHP)

Contact Info

Product

Resources

About