Fragmentation point detection of JPEG images at DHT using validator
File carving is an important, practical technique for data recovery in digital forensics investigation and is particularly useful when filesystem metadata is unavailable or damaged. The research on reassembly of JPEG files with RST markers, fragmented within the scan area have been done before. Howe...
Saved in:
| Main Authors: | , |
|---|---|
| Format: | Article |
| Published: |
2009
|
| Subjects: | |
| Online Access: | http://link.springer.com/chapter/10.1007%2F978-3-642-10509-8_20# http://link.springer.com/chapter/10.1007%2F978-3-642-10509-8_20# http://eprints.uthm.edu.my/5687/1/04%2DSecTech_2009%2DLNCS_(Dec%2DJeju_Island_Korea).pdf |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Summary: | File carving is an important, practical technique for data recovery in digital forensics investigation and is particularly useful when filesystem metadata is unavailable or damaged. The research on reassembly of JPEG files with RST markers, fragmented within the scan area have been done before. However, fragmentation within Define Huffman Table (DHT) segment is yet to be resolved. This paper analyzes the fragmentation within the DHT area and list out all the fragmentation possibilities. Two main contributions are made in this paper. Firstly, three fragmentation points within DHT area are listed. Secondly, few novel validators are proposed to detect these fragmentations. The result obtained from tests done on manually fragmented JPEG files, showed that all three fragmentation points within DHT are successfully detected using validators. |
|---|