Carving Orphaned JPEG File Fragments

Abstract

File carving techniques allow for recovery of files from storage devices in the absence of any file system metadata. When data are encoded and compressed, the current paradigm of carving requires the knowledge of the compression and encoding settings to succeed. In this paper, we advance the state of the art in JPEG file carving by introducing the ability to recover fragments of a JPEG file when the associated file header is missing. To realize this, we examined JPEG file headers of a large number of images collected from Flickr photo sharing site to identify their structural characteristics. Our carving approach utilizes this information in a new technique that performs two tasks. First, it decompresses the incomplete file data to obtain a spatial domain representation. Second, it determines the spatial domain parameters to produce a perceptually meaningful image. Recovery results on a variety of JPEG file fragments show that given the knowledge of Huffman code tables, our technique can very reliably identify the remaining decoder settings for all fragments of size 4 KiB or above. Although errors due to detection of image width, placement of image blocks, and color and brightness adjustments can occur, these errors reduce significantly when fragment sizes are >32 KiB.