Abstract: The recovery of evidence from fragmented image files is a prominent research focus in the field of file carving. To address image fragment reassembly, this paper analyzes the Joint Photographic Experts Group (JPEG) image structure and proposes a fragment connection weighting algorithm based on discrete cosine transform (DCT) semantic features, along with a weight adjustment factor that leverages image compression characteristics. By integrating these components, the algorithm effectively determines the fragment sequence in JPEG files, and a practical carving algorithm is designed. Experiments conducted on disk and memory demonstrate that the adjustment factor-based algorithm outperforms the DCT-only method in identifying true best matches (reducing false positives). Disk experiments achieve an average carving precision of 94.4%, surpassing existing methods, while memory experiments validate the feasibility of the approach, along with a theoretical analysis of failure scenarios caused by interference from software such as Windows Photo Viewer.

基于离散余弦变换语义与调节因子的图像碎片雕刻

[1]Ali RR, Mohamad KM, Jamel S, et al., 2018. A review of digital forensics methods for JPEG file carving. J Theor Appl Inform Technol, 96(17):5841-5856.

[2]Azhan NAN, Ikuesan RA, Razak SA, et al., 2022. Error level analysis technique for identifying JPEG block unique signature for digital forensic analysis. Electronics, 11(9):1468.

[3]Bharati MH, Liu JJ, Macgregor JF, 2004. Image texture analysis: methods and comparisons. Chemometr Intell Lab Syst, 72(1):57-71.

[4]Dabbaghchian S, Ghaemmaghami MP, Aghagolzadeh A, 2010. Feature extraction using discrete cosine transform and discrimination power analysis with a face recognition technology. Patt Recogn, 43(4):1431-1440.

[5]de Bock J, de Smet P, 2015. JPGcarve: an advanced tool for automated recovery of fragmented JPEG files. IEEE Trans Inform Forens Sec, 11(1):19-34.

[6]Durmus E, Mohanty M, Taspinar S, et al., 2017. Image carving with missing headers and missing fragments. IEEE Int Workshop on Information Forensics and Security, p.1-6.

[7]Ferreira WD, Ferreira CBR, da Cruz Júnior G, et al., 2020. A review of digital image forensics. Comput Electron Eng, 85: 106685.

[8]Garfinkel SL, 2007. Carving contiguous and fragmented files with fast object validation. Dig Invest, 4:2-12.

[9]Guzhov A, Wirth CT, 2025. Transformer-based file fragment type classification for file carving in digital forensics. 24^th European Conf on Cyber Warfare and Security, p.169-176.

[10]Karresand M, Shahmehri N, 2008. Reassembly of fragmented JPEG images containing restart markers. European Conf on Computer Network Defense, p.1-8.

[11]Kornblum JD, 2008. Using JPEG quantization tables to identify imagery processed by software. Dig Invest, 5:S21-S25.

[12]Li BL, Zhou Z, Zhang Y, et al., 2021. Memory fragment file carving algorithm based on the reverse of the structure chain. J Commun, 42:117-127 (in Chinese).

[13]Li Q, Sahin B, Chang EC, et al., 2011. Content based JPEG fragmentation point detection. IEEE Int Conf on Multimedia and Expo, p.1-6.

[14]Lu J, Liang Y, Han H, et al., 2025. A survey on computational solutions for reconstructing complete objects by reassembling their fractured parts. Comput Graph Forum, 44(2): e70081.

[15]Memon N, Pal A, 2006. Automated reassembly of file fragmented images using greedy algorithms. IEEE Trans Image Process, 15(2):385-393.

[16]Mohamad KM, Deris MM, 2009. Fragmentation point detection of JPEG images at DHT using validator. Int Conf on Future Generation Information Technology, p.173-180.

[17]Mullan P, Riess C, Freiling F, 2019. Forensic source identification using JPEG image headers: the case of smartphones. Dig Invest, 28:S68-S76.

[18]Pal A, Sencar HT, Memon N, 2008. Detecting file fragmentation point using sequential hypothesis testing. Dig Invest, 5:S2-S13.

[19]Ramli NIS, Hisham SI, Badshah G, 2021a. Analysis of file carving approaches: a literature review. Int Conf on Advances in Cyber Security, p.277-287.

[20]Ramli NIS, Hisham SI, Razak MFA, 2021b. Survey of file carving techniques. Int Conf of Reliable Information and Communication Technology, p.815-825.

[21]Richard GG III, Roussev V, 2005. Scalpel: a frugal, high performance file carver. 5^th Annual Digital Forensic Research Workshop, p.1-10.

[22]Sencar HT, Memon N, 2009. Identification and recovery of JPEG files with missing fragments. Dig Invest, 6:S88-S98.

[23]Shanmugasundaram K, Memon N, 2003. Automatic reassembly of document fragments via context based statistical models. 19^th Annual Computer Security Applications Conf, p.152-159.

[24]Shi Z, Zheng H, Xu C, et al., 2023. Resfusion: denoising diffusion probabilistic models for image restoration based on prior residual noise. Proc Int Conf on Neural Information Processing Systems, p.130664-130693.

[25]Singh S, Gupta VK, 2016. JPEG image compression and decompression by Huffman coding. Int J Innov Sci Res Technol, 1(5):8-14.

[26]Tang Y, Fang J, Chow KP, et al., 2016. Recovery of heavily fragmented JPEG files. Dig Invest, 18:S108-S117.

[27]Uzun E, Sencar HT, 2020. JpgScraper: an advanced carver for JPEG files. IEEE Trans Inform Forens Sec, 15:1846-1857.

[28]van Baar RB, Alink W, van Ballegooij A, 2008. Forensic memory analysis: files mapped in memory. Dig Invest, 5:S52-S57.

[29]Wu X, Han Q, Niu X, et al., 2018. JPEG image width estimation for file carving. IET Image Process, 12(7):1245-1252.

[30]Wu X, Han Q, Niu X, et al., 2019. Novel similarity measurements for reassembling fragmented image files. Chin J Electron, 28(2):331-337.

Similar articles