Recovering images with missing fragments (even headers!)

memon · 2009-10-16T08:23:00Z

Hi, We have developed some new techniques that help in carving images with missing fragments from unallocated space. In some cases we can recover the image even though the file header may be missing. In the past, others, including us, have developed techniques for carving images that assumed that all the data including the header was available. In fact, we even developed techniques to carve images that were fragmented and built a product based on such techniques. But I do not know of other work that can recover an image when there are missing fragments. Of course the part of the image corresponding to the missing data itself is not recovered (that would need magic!) but the rest of the image is recovered intact. So my question is, how important is our development in real life forensics analysis? How often do you run into situations where you think some image evidence is there but cannot view it as the image header is missing or some part in the middle is missing and hence cannot decode? BTW, for those who are interested, we published a paper at DFRWS 09 describing the technique above. The paper can be downloaded from our research website at http//isis.poly.edu/projects/evidence best,nasir

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Swako 16 years ago

11 Posts

5 Users

0 Reactions

3,259 Views

RSS

Swako

(@swako)

Active Member

Joined: 16 years ago

Posts: 18

06/11/2009 2:26 pm

Swako,
I also participated in the DC3 challenge. I remember those files but had no idea what to with them. Could you maybe PM me and give me some insight, since the contest is now over I would not be using your methods for my gain.

PM sent wink

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
161 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed