Statistical byte frequency analysis for identifying JPEG file segments

Abstract

File carving is a file recovery technique based on file structure, without the assistance of file system metadata. The important concern here is how file recovery can take place for the file segments that cannot be linked to an existing image header. This project focuses on identifying JPEG file format in hard disk storage. Digital images are broadly used in most industries. It plays a vital role in advertising, education, filming activities, etc. In business world, an image acts as an instant communication to present products and services promptly to the market. Rapid advancements in image processing technology make images more interactive and more modifiable to comply with particular preferences. However, this kind of adjustment will disturb the originality of the raw data. In previous works, researchers mostly focused on recover file segments with assistance of file markers which sometimes might be corrupted. Thus, the statistical byte frequency technique is proposed to provide alternative to address the limitations. In this study, the proposed solution was evaluated based on the accuracy and efficiency performance in identifying the distributed segments. The simulation process involved four different JPEG files format. The simulation indicates that the proposed technique gives a better performance for the files to be carved, in term of accuracy. During the simulation, most of the segments are identified with small gap between all four JPEG files format. The results are gained from k-mean clustering evaluation tool. For computational speed, it takes shorter response time to find file patterns which might due to less number of file segments. The results might be helpful for future reference in file carving program.