| With the ever increasing adoption of digital storage mediums for both legitimate and criminal use, the need for more sophisticated data recovery and forensic recovery products has also increased. Data recovery is a key component of the disaster recovery, forensics, and e-discovery markets. Traditional data recovery methods rely on file system structures like file tables to recover data that has been deleted. However, when the file system structures are not present, corrupt, or have been deliberately removed, the data while present, can not be accessed via traditional means. File carving is a technique whereby data files are extracted from a digital device without the assistance of file tables or other disk meta-data. Carving techniques are important to the forensic investigator in order to recover deleted files without resorting to directory entries, and also has important theoretical and practical significance.Since JPEG is one of the most popular image formats in the storage and distribution of digital photographic imagery it is frequently of great interest for certain types of forensic investigations. A fragmented JPEG image is currently not possible to reassemble without knowing the ordering of the fragments. This is a problem for the police when they search for illegal digital images. This paper presents a method to reassemble fragmented JPEG images without file system structures. Firstly, we starting from introduce the file system and the description of fragmentation and also explain how fragmentation occurs on disks.Then we discuss many novel methods which were applied into file carving technique, as Simple Carving, Header/maximum Size Carving, Smart Carving, Bi-fragment Gap Carving, File Mapping Carving, Graph Theoretic Carving, Carving Base On The Structure Of File and so on. Then the future directions of file carving technique are discussed.Secondly, after In-depth analysis of the internal structure, content features and compression coding process of JPEG files, we presents a JPEG file carving method based on file's content features for recovering the fragments JPEG file from unstructured original disk image. We regard process of carving the document as a probabilistic statistical model. To reassemble the fragmented JPEG file, a sequential pixel prediction model based on the neural network is proposed to determine whether or not the given fragment is adjacent to the last fragment in the original.Thirdly, in order to lower"false positive"rate, we present a new JPEG file carving method base on image contour matching. We decode the pairs of candidate matching data blocks which are the result of the previous chapter, and get the contour description of image through a series of process. After using the feature segments to construct the eigen vector, we match the contour according to the local geometric properties to find if the data blocks is adjacent to each other.At last, we design a detailed experiment steps, describe the corresponding experimental details and discuss the results of the experiment. The performance results obtained from the fragmented test-sets of DFRWS 2006, 2007 show that the method can be effectively used in recovery of fragmented JPEG files. |
PDF Full Text Request