File carving for contiguous and linearly-fragmented jpeg images and thumbnails
Kamaruddin Malik Mohamad · UTHM Institutional Repository (Universiti Tun Hussein Onn Malaysia) · 2011
File carving is a usehl technique in a digital forensics investigation for recovering lost or purposely deleted files from digital storage. it is particularly useful especially when filesystem metadata is unavailable or damaged. However, early generation file carver only able to recover non-fragnented files. This research addresses the performance of PEG image and thumbnail carving in terms of header detection, recovery rate and garbage elimination. In this thesis, a new carving tool called myKarve is introduced for carving contiguous and linearly-fragmented JPEG images and thumbnails that are caused by garbage. It is designed based on a new myKawe framework. This framework introduces the use of validated headers, image patterns, work instructions and garbage detection and cleaning. Experiments are carried out using test sets from DFRWS 2006 and 2007, and also images from the Internet. The proposed myKanz is developed using C language. Based on the comparison with Scalpel, myKarve is able to detect 57% more JPEG headers by using newly introduced validated header patterns, able to carve 33% more images and 63% more thumbnails by using a novel set of imagepatterns; and able to discard garbage from linearly fragmented JPEG files. Therefore, myKarve is a good alternative tool for canring contiguous JPEG images and thumbnails and also able to eliminate garbage from linearly-fragnented PEG files.