Research On JPEG Digital Image Carving Technology In Digital Forensics

In the age that is characterized by the progress of science and technology as well as the know-how explosion,the usage rate of digital facility has increased dramatically.At the same time,information crime activities are becoming furious increasingly.In order to solve this problem,digital image forensics is born.It mainly involves in the research of character,sound,picture and video files.As the image file is used popularly and largely,it is always the key research field in the digital image forensics.Digital image forensics includes three phases: data carving recovery,data restoration and digital forensics.Therefore,regarding the popularly used image file JPEG,this essay chooses the image carving recovery which is one way to solve the digital image forensics,take the carving recovery accuracy improvement of non-file-headline JPEG as the target,discuss the study of two phases in the JPEG image carving recovery: classification and reorganization,design and develop the carving recovery system of JPEG.The concrete work is as follow:In the classification of JPEG,regarding the low classification accuracy of high entropy files,this essay puts forward one feature-selection method that merges the NIST random check feature with bigram frequency feature and then classifies the non-file-headline fragmentized data by SVM.The experiment result shows that this method can accurately separate the JPEG fragmentized files from the large amounts of other file fragments with achieving 86.58% accuracy,which improves the high entropy files dramatically.In the reorganization of JPEG image files,regarding the lack of file headline information of non-file-signature JPEG image file,this article comes up with a method: evaluate the width of JPEG based on measuring the mutability of Euclidean distance periodicity between the neighboring MCU pixel blocks.The experiment proves that image width evaluated accuracy exceeds 99%,whic h can accurately evaluate the width of JPEG.As for the failure to know the boundary between the fragment blocks during the reorganization of non-file –headline JPEG,this article tells the method: make sure fragment block boundary between the JPEG files by means of appearance of visual illusion MCU pixel blocks which is caused by sudden orientation change of pixel content between pictures.Experiments tell that if the check accuracy of image fragment boundary exceeds 98%,this method can more accurately orientate JPEG fragment boundary location.In the research of JPEG image carving that belongs to the sphere of digital forensics,researchers so far study two phases separately: classification and reorganization of JPEG.This article units these two phases together and design the JPEG image carving recovery system.It can solve the JPEG image carving recovery conveniently and accurately through imputing binary data in the original disks and then obtaining the succeeded JPEG carving recovery image file after classifying and reorganizing,which owns practical significance.