Recovery of Damaged Compressed Files for Digital Forensic Purposes

Park, Bora; Savoldi, Antonio; Gubian, P.; Park, Jungheum; Lee, Seok Hee; Lee, Sang-Jin

doi:10.1109/mue.2008.49

Cited by 11 publications

(12 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…5 below. In the first phase, deflate-encoded data in file fragments are detected using the approach in [1,14]. A deflate-encoded data proportion is formed by a sequence of compressed blocks; each block includes header, Huffman table, and compressed data.…”

Section: Proposed Methodsmentioning

confidence: 99%

“…Therefore, they developed a tool called zsniff which tries to detect deflate header and decompress the compressed data in a file fragment. This method is quite similar to the bit-by-bit process in [14]. Moreover, in order to get a better opportunity in identifying at least one deflate-encoded block data, the data fragment size of 18 KiB was recommended.…”

Section: Related Workmentioning

confidence: 99%

“…Firstly, a deflate-encoded [13] data proportion is identified from a file fragment, and then this data proportion is decompressed to get the underlying data -inflate data. Special methods such as the approaches in [1,14] enable deflate-encoded data fragment detection and decompression. Secondly, the inflate data is clustered into one of three group depending on its entropy value which is low, medium or high.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A New Approach to Compressed File Fragment Identification

Nguyen

Tran

et al. 2015

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

Identifying the underlying type of a file given only a file fragment is a big challenge in digital forensics. Many methods have been applied to file type identification; however the identification accuracies of most of file types are still very low, especially for files having complex structures because their contents are compound data built from different data types. In this paper, we propose a new approach based on the deflate-encoded data detection, entropy-based clustering, and the use of machine learning techniques to identify deflate-encoded file fragments. Experiments on the popular compound file type showed high identification accuracy for the proposed method.

show abstract

Section: Proposed Methodsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A New Approach to Compressed File Fragment Identification

Nguyen

Tran

et al. 2015

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

show abstract

“…However, many security-related applications, such as ransomware detection, traffic analysis and digital forensics, generally do not have access to whole-file information, but rather work at the level of fragments of data. In these settings, the metadata that is required by parsers is not present or is incomplete [35]. Given this issue, a number of works have been looking at alternative tests to distinguish between encrypted and compressed content [12,14,23,30,32,34,41].…”

Section: Introductionmentioning

confidence: 99%

EnCoD: Distinguishing Compressed and Encrypted File Fragments

Gaspari

Hitaj

Pagnotta

et al. 2020

Network and System Security

View full text Add to dashboard Cite

Reliable identification of encrypted file fragments is a requirement for several security applications, including ransomware detection, digital forensics, and traffic analysis. A popular approach consists of estimating high entropy as a proxy for randomness. However, many modern content types (e.g. office documents, media files, etc.) are highly compressed for storage and transmission efficiency. Compression algorithms also output high-entropy data, thus reducing the accuracy of entropy-based encryption detectors.Over the years, a variety of approaches have been proposed to distinguish encrypted file fragments from high-entropy compressed fragments. However, these approaches are typically only evaluated over a few, selected data types and fragment sizes, which makes a fair assessment of their practical applicability impossible. This paper aims to close this gap by comparing existing statistical tests on a large, standardized dataset. Our results show that current approaches cannot reliably tell apart encryption and compression, even for large fragment sizes. To address this issue, we design EnCoD, a learning-based classifier which can reliably distinguish compressed and encrypted data, starting with fragments as small as 512 bytes. We evaluate EnCoD against current approaches over a large dataset of different data types, showing that it outperforms current state-of-the-art for most considered fragment sizes and data types.

show abstract

“…Lakhani [14] adjusted the construction rules of the encoder and dictionary table and verified the data by adding redundant bits. Park et al [15] used compression coding rules to detect corrupted ZIP compressed data. However, the exhaustive error correction methods can correct only 1 bit each time to ensure the speed of error correction.…”

Section: Introductionmentioning

confidence: 99%

Repair and Restoration of Corrupted LZSS Files

2019

View full text Add to dashboard Cite

Data compression and decompression have been widely used in modern communication and data transmission. But how to decompress the corrupted lossless compressed files remains a challenge. Aiming at the Lempel-Ziv-Storer-Szymanski (LZSS), a lossless data compression algorithm widely used in the field of general coding, this paper proposes an effective method to repair the errors and decompress and restore the corrupted LZSS files, and provides the theoretical basis for the method. By using the residual redundancy left by the LZSS encoder to carry the check information, the method can repair the errors in LZSS compressed data without any loss of compression performance. The proposed method neither requires additional bits nor changes coding rules or data formats. It is fully compatible with standard algorithms. That is, the data compressed by LZSS with error repair capability can still be decompressed by the standard LZSS decoder. The experimental results verify the validity and practicability of the proposed method.

show abstract

Recovery of Damaged Compressed Files for Digital Forensic Purposes

Cited by 11 publications

References 3 publications

A New Approach to Compressed File Fragment Identification

A New Approach to Compressed File Fragment Identification

EnCoD: Distinguishing Compressed and Encrypted File Fragments

Repair and Restoration of Corrupted LZSS Files

Contact Info

Product

Resources

About