Files stored on digital media are broken into smaller blocks prior to storage. Most of the time these blocks are stored sequentially on the media. Increasing sizes of files and complexity of their format often lead to fragmentation in the sequences of blocks written to media. For example, photo and video files stored in a memory card of a camera are often fragmented. Another example is email inbox files stored on hard drives are fragmented. Recovering fragmented files from a media is a challenge faced by digital forensics and data recovery. This project formally examines fragmentation and develop practical algorithms to recover deleted files. The algorithms and methods developed are independent of operating systems, file systems, or digital media.

Participants:

Resources:

• Identification and recovery of JPEG files with missing fragments
  Digital Forensics Research Workshop (DFRWS), August 2009
• The Evolution of File Carving: The benefits and problems of forensics recovery
  IEEE Signal Processing Magazine, Vol. 26. No 2. March 2009
• Detecting File Fragmentation Point Using Sequential Hypothesis Testing [slides]
  Digital Forensics Research Workshop (DFRWS), August 2008 (Best Paper Award)
• Automated Reassembly of File Fragmented Images Using Greedy Algorithms
  IEEE Transactions on Image Processing, Vol. 15. No 3. March 2006
• Automated Reassembly of File Fragmented Images Using Greedy Algorithms
  Master's Thesis, Department of Computer and Information Science, Polytechnic University, 2005
• Automated Reassembly of Fragmented Images
  IEEE International Conference on Acoustics, Speech, and Signal Processing, 2003
• Automatic Reassembly of Document Fragments via Context Based Statistical Models
  Annual Computer Security Applications Conference, 2003

Back to Projects