Frame-Based Recovery of Corrupted Video Files Using Video Codec Specifications

Abstract

In digital forensics, recovery of a damaged or altered video file plays a crucial role in searching for evidences to resolve a criminal case. This paper presents a frame-based recovery technique of a corrupted video file using the specifications of a codec used to encode the video data. A video frame is the minimum meaningful unit of video data. Many existing approaches attempt to recover a video file using file structure rather than frame structure. In case a target video file is severely fragmented or even has a portion of video overwritten by other video content, however, video file recovery of existing approaches may fail. The proposed approach addresses how to extract video frames from a portion of video to be restored as well as how to connect extracted video frames together according to the codec specifications. Experiment results show that the proposed technique successfully restores fragmented video files regardless of the amount of fragmentations. For a corrupted video file containing overwritten segments, the proposed technique can recover most of the video content in non-overwritten segments of the video file.

Broken Integrity Detection of Video Files in Video Event Data Recorders

“…For digital forensics investigators, in addition to integrity verification, determining how many frames and the location in disk storage from which they can be recovered are also interesting issues [22][23]. In our scenarios, we created a scheme associated with frame recovery by calculating the size of the recoverable frame area.…”

Reassembling fragmented BMP files based on padding bytes

“…Reassembling fragmented files [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15] is to reconstruct digital files from a collection of randomly mixed fragments of these files. It arises in digital forensics and plays a crucial role in seizing digital evidence from scattered digital files.…”