Name
Abstract | ||
|---|---|---|
Traditional file recovery methods rely on file system information, which are ineffective when file system information isn't available. File carving is a file recovery method that recovers files according to their structure and content without file system information, which is widely used in digital forensics. As the important carriers of digital information, multimedia files are important digital evidence. In this paper, a new multimedia file carving approach is proposed to improve the recovery accuracy of high entropy file fragments. The fragmented files can be recovered by a hierarchical carving process, including file header identification via entropy, file fragment type classification, and file reassembly via parallel unique path approach. A new file type classification method is constructed based on support vector machine, by using the features of BFD (byte frequency distribution) and ROC (rate of change). Four different datasets, such as DFRWS 2006/2007 challenge datasets, dataset simulating actual disk, dataset with randomly disordered fragments, and dataset with biomedical images, are employed in our experiments. The results show that JPEG recovery accuracy is improved greatly compared with that of Photo Rec tool. Our method performs best in the situation where the order of fragments is completely confusing. |
Year | DOI | Venue |
|---|---|---|
2014 | 10.1109/BIBE.2014.31 | BIBE |
Keywords | Field | DocType |
byte frequency distribution,high entropy file fragments,file reassembly,file fragment,parallel unique path approach,file recovery methods,file fragment type classification,svm,rate of change,digital forensics,support vector machine,file system information,file organisation,biomedical image,digital evidence,biomedical images,file type classification,file carving,bioinformatics,photo rec tool,support vector machines,multimedia files carving,file header identification,entropy,transform coding,accuracy,feature extraction | File format,File system,Computer science,Design rule for Camera File system,Torrent file,File carving,Indexed file,Multimedia,File system fragmentation,Computer file | Conference |
ISSN | Citations | PageRank |
2471-7819 | 3 | 0.41 |
References | Authors | |
11 | 6 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Weidong Qiu | 1 | 119 | 19.01 |
| Run Zhu | 2 | 3 | 0.41 |
| Jie Guo | 3 | 289 | 56.10 |
| Xiaoming Tang | 4 | 3 | 0.41 |
| Bozhong Liu | 5 | 21 | 3.88 |
| Zheng Huang | 6 | 39 | 13.80 |