Research On Key Technologies Of Multimedia Files Carving

The importance of information is increasing in the information society.Files can be damaged via device failure, human error, deliberate destructionand computer criminal activities, thus file recovery is focused. Data carvingis a file recovery method which recovers files according to their structureand content without file system information, which is widely used in digitalforensics. As important carriers of digital information, multimedia files areimportant digital evidence, so the paper studies the key technologies ofmultimedia files carving. Based on file header identification, file fragmenttype classification and reassembly, the paper proposes carving methods formultimedia files and achieves JPEG carving program. The main work is asbelow:Firstly, we propose a new file fragment type classification methodbased on supervised learning, using support vector machines. Both the bytefrequency distribution and the rate of change of file fragments are taken intoconsideration. The experiment shows the method is effective.Secondly, a new multimedia files carving methods is proposed basedon signature and statistical approaches for file fragment preliminaryclassification, the above file type classification method for depthclassification and the Parallel Unique Path approach for reassembly.Finally, according to the multimedia files carving algorithm, weachieve a JPEG carving program. The experiment indicates that theproposed method can correctly recover JPEG files from dataset without filesystem information, proving feasibility and effectiveness of the method.