Orphaned File Fragment Carving: A New Approach to Recovering Photographic Evidence

SpeakerHusrev Taha Sencar
Organization TOBB Univ. of Economics and Technology
Location3211 Engineering Building II
Start Date May 15, 2017 11:00 AM
End Date May 15, 2017 12:00 PM

Digital Forensics cluster candidate


An important aspect of digital forensics is concerned with acquisition and analysis of digital evidence. Today, with more and more data created and stored across countless devices, the need for improved data recovery capabilities has become critical for digital forensic investigations. File carving techniques seek to address this challenge by retrieving files and fragments of files from storage devices when the file system information for a device is corrupt or missing. Despite significant progress in this area, a fundamental limitation of all existing file carving techniques is that when files are encoded and compressed (like most multimedia files), they allow recovery only if the file header encompassing all the decoding parameters is available. Hence if a file is partially intact with its header deleted, recovery cannot be performed and data that might include crucial evidence is unfortunately ignored.

This talk will address the above problem and introduce a capability that advances the state of the art in file carving by recovering fragments of a JPEG file when the associated compression metadata is missing. The underlying approach is data-driven in that it examines encoding settings of a large number of photos captured by a wide variety of digital camera makes and models to identify their characteristics. This information is then utilized to devise an algorithm that both decompresses the incomplete file data and determines all the parameters needed for rendering the partial image. Recovery results from practical deployment show that the proposed file carving technique is able to uncover a new class of evidence; therefore, it has significant implications on forensic investigations and intelligence gathering operations.

Husrev Taha Sencar is an Associate Professor of Computer Engineering Department at TOBB University of Economics and Technology, Ankara, Turkey. Between 2012 and 2015 he served as the director of the New York University Abu Dhabi’s cyber security center in Abu Dhabi, UAE. He obtained BSc and MSc degrees in Electrical and Electronics engineering, respectively, from Middle East Technical University and Baskent University of Ankara, Turkey. He received Ph.D. degree in Electrical and Computer Engineering from New Jersey Institute of Technology in 2004. His research interests are in digital forensics, multimedia computing and security.



  May 2017
Sun Mon Tues Wed Thu Fri Sat