Identification and recovery of JPEG files with missing fragments

Husrev T. Sencar, Nasir Memon

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Recovery of fragmented files proves to be a challenging task for encoded files like JPEG. In this paper, we consider techniques for addressing two issues related to fragmented JPEG file recovery. First issue concerns more efficient identification of the next fragment of a file undergoing recovery. Second issue concerns the recovery of file fragments which cannot be linked to an existing image header or for which there is no available image header. Current file recovery approaches are not well suited to deal with these practical issues. In addressing these problems, we utilize JPEG file format specifications. More specifically, we propose a technique based on bit sequence matching to identify fragments created by the same Huffman code tables. We also address the construction of a pseudo header needed for recovery of stand-alone file fragments. Some experimental results are provided to support our claims.

Original languageEnglish (US)
Title of host publicationDFRWS 2009 Annual Conference
StatePublished - 2009
Event9th Annual Digital Forensic Research Workshop, DFRWS 2009 - Montreal, QC, Canada
Duration: Aug 17 2009Aug 19 2009

Other

Other9th Annual Digital Forensic Research Workshop, DFRWS 2009
CountryCanada
CityMontreal, QC
Period8/17/098/19/09

Keywords

  • File recovery
  • Fragmentation
  • Huffman code tables
  • JPEG/JFIF

ASJC Scopus subject areas

  • Information Systems

Fingerprint Dive into the research topics of 'Identification and recovery of JPEG files with missing fragments'. Together they form a unique fingerprint.

Cite this