Data Carving Linearly Fragmented JPEG Using File Structured Based Technique

Abstract

Data carving is a robust technique that is used in the digital forensic investigation for data recovery. It is a file recovery technique that extract files based on the file format characteristic specifics and structure in which it can recover data without relying on metadata. Over the years, it has gathered the attention of researcher as it can overcome the shortcomings of the orthodox method of file recovery. However, many of the existing file carving tools were not specifically aimed and designed in consideration of fragmented file and fragmentation of a file can exist in different multitude of scenario. Thus, this paper proposes file carving tool that can recover linearly fragmented JPEG file using structured based technique where this technique utilizes the internal layout of the JPEG file with its elements such as header, footer, and the file size, to carve out non fragmented as well as linearly fragmented JPEG image. The proposed tool is tested and evaluated using Digital Forensic Research Workshop (DFRWS) 2006 challenge dataset where the proposed tool are able to carve out 8 JPEG images that are aligned with the project scope and the remaining unrecovered images are out of project scope where it is bi-fragmented or contained non-JPEG files in the fragmentation. Hence, the result shows that this tool has is capable of carving non-fragmented as well as linearly fragmented JPEG image and the objectives are achieved