JpgScraper : An Advanced Carver for JPEG Files

Abstract

Orphaned file fragment carving is concerned with recovering contents of encoded data in the absence of any coding metadata. Constructing an orphaned file carver requires addressing three challenges: a specialized decoder to interpret partial file data; the ability to discriminate a specific type of encoded data from all other types of data; and comprehensive prior knowledge on possible encoding settings. In this work, we build on the ability to render a partial image contained within a segment of JPEG coded data to introduce a new carving tool that addresses all these challenges. Towards this goal, we first propose a new method that discriminates JPEG file data from among 993 file data types with 97.7% accuracy. We also introduce a method for robustly delimiting entropy coded data segments of JPEG files. This in turn allows us to identify partial JPEG file headers with zero false rejection and 0.1% of false alarm rate. Secondly, we examine a very diverse image set comprising more than 7 million images. This ensures comprehensive coverage of coding parameters used by 3,269 camera models and a wide variety of image editing tools. Further, we assess the potential impact of the developed tool on practice in terms of the amount of new evidence that it can recover. Recovery results on a set of used SD cards purchased online show that our carver is able to recover 24% more image data as compared to existing file carving tools. Evaluations performed on a standard dataset also show that JpgScraper improves the state-of-the-art significantly in carving JPEG file data.