An improved file carver of intertwined jpeg images using X_myKarve

File carving is a common technique for retrieving evidence data from computers that have been used for crime activities to assist crimes investigations especially in solving pornography cases where traditional data recovery fail. However, carving fragmented JPEG files are not easy to solve due to the complexity of determining the fragmentation point. In this research, X_myKarve’s framework is introduced to address the fragmentation issues that occur in JPEG images. The framework consists of six steps namely, dataset acquisition and preparation, pre-processing, work instruction generation, image carving and reconstitution, image completeness validation and fragmentation handling. X_myKarve is extended using myKarve’s framework by introducing a new technique, deletion by binary search to detect fragmentation point which is used to separate a file into several individual fragments. These fragments are then reassembled with the correct pairs which form a complete and correct image. X_myKarve is tested using various datasets namely DFRWS 2006, DFRWS 2007 and additional datasets which are prepared and designed to simulate a particular fragmentation problems addressed in this research. The result shows that X_myKarve is capable of carving 23.8% more than myKarve and 45.4% more than RevIt for DFRWS 2006 datasets where X_myKarve can carve intertwined fragmented JPEG images completely compared to myKarve and RevIt. X_myKarve is a good alternative for carving more fragmented JPEG files that are intertwined with each other.

Name dc:type.qualificationname

phd

Level dc:type.qualificationlevel

doctoral

Grantor dc:publisher.institution

Universiti Tun Hussein Onn Malaysia

Year dc:date.issued

2014

Author dc:creator

• Abdullah, Nurul Azma

• QA76 Computer software

Language dc:language

en