Abstract
File carving is a powerful technique for both digital forensics investigations and data recovery. It offers the flexibility to recover data stored on digital media independent of the underlying file system. Thus, it can be used in the cases where we need to recover deleted files or when we have a corrupted, overwritten, or unknown file system. In this paper, we present a novel video file carving (VidCarve) framework to recover and reassemble fragmented video files into playable video files. VidCarve consists of four main components: identification and recovery, weight assignment, reassembly, and file construction. This paper focuses on the weight assignment and reassembly processes where the codec specification parameters of carved fragments were overwritten. We propose several weight assignment techniques to estimate the probability of adjacency between video fragments. Based on these weights, the reassembly algorithm recovers the video files by constructing their correct sequences. We provide experimental results for the proposed techniques of weight assignment and reassembly. We claim that the overall accuracy rate can produce forensically sound evidence and play a critical role in the process of digital evidence recovery in many criminal cases.
| Original language | British English |
|---|---|
| Article number | 8703058 |
| Pages (from-to) | 131-143 |
| Number of pages | 13 |
| Journal | IEEE Transactions on Sustainable Computing |
| Volume | 6 |
| Issue number | 1 |
| DOIs | |
| State | Published - 1 Jan 2021 |
Keywords
- data recovery
- digital evidence
- Digital forensics
- file carving
- fragment reassembly
- fragmented video files