Oscar - File Type and Camera Identification Using the Structure of Binary Data Fragments
Martin Karresand, Nahid Shahmehri · 2006
Mapping out the contents of fragmented storage media is hard if the file system has been corrupted, especially as the current forensic tools rely on meta information to do their job. If it were possible to find all fragments belonging to a certain file type, it might also be possible to recover a lost file. The Oscar method identifies the file type of data fragments based on their structure. This paper presents an improvement of the Oscar method. The new version is built on using 2-grams to create a model of different file types. The method is evaluated for JPEG, Windows executables, and zip files, reaching a 100% detection rate with 0.12% false positives for JPEG. We also use the method to identify the camera make used to capture a JPEG picture from a fragment of the picture.