An improved file carver of intertwined jpeg images using X_myKarve
File carving is a common technique for retrieving evidence data from computers that have been used for crime activities to assist crimes investigations especially in solving pornography cases where traditional data recovery fail. However, carving fragmented JPEG files are not easy to solve due...
Saved in:
Main Author: | |
---|---|
Format: | Thesis |
Language: | English English English |
Published: |
2014
|
Subjects: | |
Online Access: | http://eprints.uthm.edu.my/1218/1/24p%20NURUL%20AZMA%20ABDULLAH.pdf http://eprints.uthm.edu.my/1218/2/NURUL%20AZMA%20ABDULLAH%20COPYRIGHT%20DECLARATION.pdf http://eprints.uthm.edu.my/1218/3/NURUL%20AZMA%20ABDULLAH%20WATERMARK.pdf http://eprints.uthm.edu.my/1218/ |
Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
Institution: | Universiti Tun Hussein Onn Malaysia |
Language: | English English English |
Summary: | File carving is a common technique for retrieving evidence data from computers that
have been used for crime activities to assist crimes investigations especially in solving
pornography cases where traditional data recovery fail. However, carving fragmented
JPEG files are not easy to solve due to the complexity of determining the fragmentation
point. In this research, X_myKarve’s framework is introduced to address the
fragmentation issues that occur in JPEG images. The framework consists of six steps
namely, dataset acquisition and preparation, pre-processing, work instruction
generation, image carving and reconstitution, image completeness validation and
fragmentation handling. X_myKarve is extended using myKarve’s framework by
introducing a new technique, deletion by binary search to detect fragmentation point
which is used to separate a file into several individual fragments. These fragments are
then reassembled with the correct pairs which form a complete and correct image.
X_myKarve is tested using various datasets namely DFRWS 2006, DFRWS 2007 and
additional datasets which are prepared and designed to simulate a particular
fragmentation problems addressed in this research. The result shows that X_myKarve
is capable of carving 23.8% more than myKarve and 45.4% more than RevIt for
DFRWS 2006 datasets where X_myKarve can carve intertwined fragmented JPEG
images completely compared to myKarve and RevIt. X_myKarve is a good alternative
for carving more fragmented JPEG files that are intertwined with each other. |
---|