File carving for contiguous and linearly-fragmented jpeg images and thumbnails

Mohamad, Kamaruddin Malik (2011) File carving for contiguous and linearly-fragmented jpeg images and thumbnails. PhD thesis, Universiti Tun Hussein Onn Malaysia.

[img]
Preview
PDF
622Kb

Abstract

File carving is a usehl technique in a digital forensics investigation for recovering lost or purposely deleted files from digital storage. it is particularly useful especially when filesystem metadata is unavailable or damaged. However, early generation file carver only able to recover non-fragnented files. This research addresses the performance of PEG image and thumbnail carving in terms of header detection, recovery rate and garbage elimination. In this thesis, a new carving tool called myKarve is introduced for carving contiguous and linearly-fragmented JPEG images and thumbnails that are caused by garbage. It is designed based on a new myKawe framework. This framework introduces the use of validated headers, image patterns, work instructions and garbage detection and cleaning. Experiments are carried out using test sets from DFRWS 2006 and 2007, and also images from the Internet. The proposed myKanz is developed using C language. Based on the comparison with Scalpel, myKarve is able to detect 57% more JPEG headers by using newly introduced validated header patterns, able to carve 33% more images and 63% more thumbnails by using a novel set of imagepatterns; and able to discard garbage from linearly fragmented JPEG files. Therefore, myKarve is a good alternative tool for canring contiguous JPEG images and thumbnails and also able to eliminate garbage from linearly-fragnented PEG files.

Item Type:Thesis (PhD)
Subjects:T Technology > TK Electrical engineering. Electronics Nuclear engineering > TK6600 Phototelegraphy. Picture telegraphy
ID Code:2417
Deposited By:Normajihan Abd. Rahman
Deposited On:18 Apr 2012 12:47
Last Modified:18 Apr 2012 12:47

Repository Staff Only: item control page