File carving is a powerful technique for both digital forensics investigations and data recovery. It offers the flexibility to recover data stored on digital media independent of the underlying file system. Thus, it can be used in the cases where we need to recover deleted files or when we have a corrupted, overwritten or unknown file system. In this paper, we present a novel video file carving (VidCarve) framework to recover and reassemble fragmented video files into playable video files. VidCarve consists of four main components: identification and recovery, weight assignment, reassembly and file construction. This paper focuses on the weight assignment and reassembly processes where the codec specification parameters of carved fragments were overwritten. We propose several weight assignment techniques to estimate the probability of adjacency between video fragments. Based on these weights, the reassembly algorithm recovers the video files by constructing their correct sequences. We provide experimental results for the proposed techniques of weight assignment and reassembly. We claim that the overall accuracy rate can produce forensically sound evidence and play a critical role in the process of digital evidence recovery in many criminal cases.
Techniques for measuring the probability of adjacency between carved video fragments: The VidCarve approach / K. Alghafli, C.Y. Yeun, E. Damiani. - In: IEEE TRANSACTIONS ON SUSTAINABLE COMPUTING. - ISSN 2377-3782. - (2018). [Epub ahead of print] [10.1109/TSUSC.2019.2914192]
Techniques for measuring the probability of adjacency between carved video fragments: The VidCarve approach
E. Damiani
2018
Abstract
File carving is a powerful technique for both digital forensics investigations and data recovery. It offers the flexibility to recover data stored on digital media independent of the underlying file system. Thus, it can be used in the cases where we need to recover deleted files or when we have a corrupted, overwritten or unknown file system. In this paper, we present a novel video file carving (VidCarve) framework to recover and reassemble fragmented video files into playable video files. VidCarve consists of four main components: identification and recovery, weight assignment, reassembly and file construction. This paper focuses on the weight assignment and reassembly processes where the codec specification parameters of carved fragments were overwritten. We propose several weight assignment techniques to estimate the probability of adjacency between video fragments. Based on these weights, the reassembly algorithm recovers the video files by constructing their correct sequences. We provide experimental results for the proposed techniques of weight assignment and reassembly. We claim that the overall accuracy rate can produce forensically sound evidence and play a critical role in the process of digital evidence recovery in many criminal cases.File | Dimensione | Formato | |
---|---|---|---|
Techniques for measuring the probability of.pdf
accesso riservato
Tipologia:
Publisher's version/PDF
Dimensione
638.71 kB
Formato
Adobe PDF
|
638.71 kB | Adobe PDF | Visualizza/Apri Richiedi una copia |
Pubblicazioni consigliate
I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.