Advanced carving techniques

Cohen, Michael

doi:10.1016/j.diin.2007.10.001

Cited by 53 publications

(42 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…JPEG is popular because of its compressed file that can reduce the size required to allocate an image. Joint Photographic Experts Group (JPEG) was formed by International Telegraph and Telephone Consultative Committee in 1986 inspired by an effort of International Organization of Standard (ISO) to find ways to use high resolution graphics and pictures in computers [2]. JPEG introduced compression standard for both grayscale and color continuous-tone images.…”

Section: A An Overview Of Jpeg Standardmentioning

confidence: 99%

“…For statistical tests, the statistic of each block is compared to a model of each file type to identify the block. Cohen [2] used the mapping function to map between the bytes contained in the file to the bytes within the image itself. In this case, carving process is the process to estimate the mapping function.…”

Section: B Fragmentation Pointsmentioning

confidence: 99%

“…Carving, one of important fields in DF is used to explain the process of extracting a raw image from unstructured digital forensic images based on the content rather than using file system metadata for data recovery and computer forensics [1], [2], [3]. Simply, file carving is a process of recovering files from the unallocated space of disk without knowing the file system [4].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Reducing Falsely Detected JPEG’s Fragmentation Point Using Unique Hex Patterns (UHP)

Azma

Ibrahim²,

Malik³

et al. 2013

Proceedings of the 2nd International Conference on Advances in Computer Science and Engineering

View full text Add to dashboard Cite

Abstract-To increase number of evidence obtained in an effort to fight cyber perpetrator, many studies have been conducted in addressing problem of fragmented JPEG images. However, thumbnail/s is/are always been mistaken as fragmentation point of fragmented JPEG images. This paper discusses on how thumbnail can be used to reduce false detection. The main contribution of this paper is introducing patterns to distinguish the header of original JPEG images with thumbnail/s.

show abstract

Section: A An Overview Of Jpeg Standardmentioning

confidence: 99%

Section: B Fragmentation Pointsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Reducing Falsely Detected JPEG’s Fragmentation Point Using Unique Hex Patterns (UHP)

Azma

Ibrahim²,

Malik³

et al. 2013

Proceedings of the 2nd International Conference on Advances in Computer Science and Engineering

View full text Add to dashboard Cite

show abstract

“…This means that a file carver can be made to run in streaming fashion by changing the runtime system. Additionally, state-of-the-art file carving algorithms (e.g., [8]) can be plugged into the system without affecting the other components.…”

Section: Model-driven Digital Forensicsmentioning

confidence: 99%

“…Our software tool Excavator represents the state-of-the-art in digital forensics data recovery, implementing fragmented file recovery [10,8] and a streambased processing model [11]. Furthermore, our model-driven approach distinguishes itself by allowing high-level specification of elaborate data structures not implemented in popular file carvers.…”

Section: Related Workmentioning

confidence: 99%

Domain-Specific Optimization in Digital Forensics

Bos

Storm

2012

Theory and Practice of Model Transformations

View full text Add to dashboard Cite

Abstract. File carvers are forensic software tools used to recover data from storage devices in order to find evidence. Every legal case requires different trade-offs between precision and runtime performance. The resulting required changes to the software tools are performed manually and under the strictest deadlines. In this paper we present a model-driven approach to file carver development that enables these trade-offs to be automated. By transforming high-level file format specifications into approximations that are more permissive, forensic investigators can trade precision for performance, without having to change source. Our study shows that performance gains up to a factor of three can be achieved, at the expense of up to 8% in precision and 5% in recall.

show abstract