Carving orphaned jpeg file fragments

Erkam Uzun, Husrev Taha Sencar

Research output: Contribution to journalArticlepeer-review

29 Citations (Scopus)

Abstract

File carving techniques allow for recovery of files from storage devices in the absence of any file system metadata. When data are encoded and compressed, the current paradigm of carving requires the knowledge of the compression and encoding settings to succeed. In this paper, we advance the state of the art in JPEG file carving by introducing the ability to recover fragments of a JPEG file when the associated file header is missing. To realize this, we examined JPEG file headers of a large number of images collected from Flickr photo sharing site to identify their structural characteristics. Our carving approach utilizes this information in a new technique that performs two tasks. First, it decompresses the incomplete file data to obtain a spatial domain representation. Second, it determines the spatial domain parameters to produce a perceptually meaningful image. Recovery results on a variety of JPEG file fragments show that given the knowledge of Huffman code tables, our technique can very reliably identify the remaining decoder settings for all fragments of size 4 KiB or above. Although errors due to detection of image width, placement of image blocks, and color and brightness adjustments can occur, these errors reduce significantly when fragment sizes are >32 KiB.

Original languageEnglish
Article number7067355
Pages (from-to)1549-1563
Number of pages15
JournalIEEE Transactions on Information Forensics and Security
Volume10
Issue number8
DOIs
Publication statusPublished - 1 Aug 2015
Externally publishedYes

Fingerprint

Dive into the research topics of 'Carving orphaned jpeg file fragments'. Together they form a unique fingerprint.

Cite this