Taxonomy of Data Fragment Classification Techniques

Poisel, Rainer; Rybnicek, Marlies; Tjoa, Simon

doi:10.1007/978-3-319-14289-0_6

Cited by 5 publications

(2 citation statements)

References 61 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, they did not evaluate the contributions of the chosen feature vectors, leaving it for future work. Interested readers are referred to Poisel et al [52] for a taxonomy of data fragment classification techniques.…”

Section: File Fragment Carvingmentioning

confidence: 99%

Creating a Map of User Data in NTFS to Improve File Carving

Karresand

Warnqvist

Lindahl

et al. 2019

Advances in Digital Forensics XV

View full text Add to dashboard Cite

Digital forensics and, especially, file carving are burdened by the large amounts of data that need to be processed. Attempts to solve this problem include efficient carving algorithms, parallel processing in the cloud and data reduction by filtering uninteresting files. This research addresses the problem by searching for data where it is more likely to be found. This is accomplished by creating a probability map for finding unique data at various logical block addressing positions in storage media. SHA-1 hashes of 512 B sectors are used to represent the data. The results, which are based on a collection of 30 NTFS partitions from computers running Microsoft Windows 7 and later versions, reveal that the mean probability of finding unique hash values at different logical block addressing positions vary between 12% to 41% in an NTFS partition. The probability map can be used by a forensic analyst to prioritize relevant areas in storage media without the need for a working filesystem. It can also be used to increase the efficiency of hash-based carving by dynamically changing the random sampling frequency. The approach contributes to digital forensic processes by enabling them to focus on interesting regions in storage media, increasing the probability of obtaining relevant results faster.

show abstract

Section: File Fragment Carvingmentioning

confidence: 99%

Creating a Map of User Data in NTFS to Improve File Carving

Karresand

Warnqvist

Lindahl

et al. 2019

Advances in Digital Forensics XV

View full text Add to dashboard Cite

show abstract

“…This can be performed using file fragment classification, to identify the known and unknown data fragments. Three categories of classification have been summarized for JPEG fragments classification: The signature-based approach, statistical approach, and Artificial Intelligence (AI) approach [30]. While the signature-based approach is based on a JPEG header, footer, and markers, a statistical approach is based on entropy information and byte frequency analysis.…”

Section: Introductionmentioning

confidence: 99%

Error Level Analysis Technique for Identifying JPEG Block Unique Signature for Digital Forensic Analysis

et al. 2022

View full text Add to dashboard Cite

The popularity of unique image compression features of image files opens an interesting research analysis process, given that several digital forensics cases are related to diverse file types. Of interest has been fragmented file carving and recovery which forms a major aspect of digital forensics research on JPEG files. Whilst there exist several challenges, this paper focuses on the challenge of determining the co-existence of JPEG fragments within various file fragment types. Existing works have exhibited a high false-positive rate, therefore rendering the need for manual validation. This study develops a technique that can identify the unique signature of JPEG 8 × 8 blocks using the Error Level Analysis technique, implemented in MATLAB. The experimental result that was conducted with 21 images of JFIF format with 1008 blocks shows the efficacy of the proposed technique. Specifically, the initial results from the experiment show that JPEG 8 × 8 blocks have unique characteristics which can be leveraged for digital forensics. An investigator could, therefore, search for the unique characteristics to identify a JPEG fragment during a digital investigation process.

show abstract

Deleted file fragment dating by analysis of allocated neighbors

Bahjat

Jones

2019

Digital Investigation

View full text Add to dashboard Cite

Taxonomy of Data Fragment Classification Techniques

Cited by 5 publications

References 61 publications

Creating a Map of User Data in NTFS to Improve File Carving

Creating a Map of User Data in NTFS to Improve File Carving

Error Level Analysis Technique for Identifying JPEG Block Unique Signature for Digital Forensic Analysis

Deleted file fragment dating by analysis of allocated neighbors

Contact Info

Product

Resources

About