Fragmentation point detection of JPEG images at DHT using validator

Mohamad, Kamaruddin Malik and Mat Deris, Mustafa (2009) Fragmentation point detection of JPEG images at DHT using validator. Future Generation Infromation Technology .

[img]
Preview
PDF
102Kb

Official URL: http://link.springer.com/chapter/10.1007%2F978-3-6...

Abstract

File carving is an important, practical technique for data recovery in digital forensics investigation and is particularly useful when filesystem metadata is unavailable or damaged. The research on reassembly of JPEG files with RST markers, fragmented within the scan area have been done before. However, fragmentation within Define Huffman Table (DHT) segment is yet to be resolved. This paper analyzes the fragmentation within the DHT area and list out all the fragmentation possibilities. Two main contributions are made in this paper. Firstly, three fragmentation points within DHT area are listed. Secondly, few novel validators are proposed to detect these fragmentations. The result obtained from tests done on manually fragmented JPEG files, showed that all three fragmentation points within DHT are successfully detected using validators.

Item Type:Article
Uncontrolled Keywords:file carving; digital evidence; digital forensics; data recovery
Subjects:Q Science > QA Mathematics > QA76 Computer software
Divisions:Faculty of Computer Science and Information Technology > Department of Information Security
ID Code:5687
Deposited By:Dr Kamaruddin Malik Mohamad
Deposited On:28 Oct 2014 10:44
Last Modified:28 Oct 2014 10:44

Repository Staff Only: item control page