Identification of fragmented JPEG files in the absence of file systems

Abstract

Identifying fragmented and deleted files from scattered digital storage become crucial needs in computer forensic. Storage media experience regular space fragmentation which gives direct consequence to the files system series. This paper specifies a case where the jpeg files are heavily fragmented with absent file header which contains maximum information for the stored data can be easily retrieved. The problem is formulated using statistical byte frequency analysis for identifying the group of jpeg file fragments. Several related works have addressed the issue of classifying variety types of file format with high occurrence of being fragmented such as avi, doc, wav file and etc. These files have been tagged as among the larger file format. We provide techniques for identifying the pattern of file fragments distribution and describe roles of selected clustering attributes. Finally, we provide experimental results presenting that the jpeg fragments distribution can be retrieved with quite small gap differences between the groups.