e-space
Manchester Metropolitan University's Research Repository

Identification and recovery of video fragments for forensics file carving

Alghafli, K and Martin, TA (2017) Identification and recovery of video fragments for forensics file carving. In: 11th International Conference for Internet Technology and Secured Transactions (ICITST), 05 December 2017 - 07 March 2017, Barcelona.

[img]
Preview

Download (271kB) | Preview

Abstract

In digital forensics, file carving of video files is an important process in the recovery of video evidence needed for many criminal cases. Traditional carving techniques recover video files based on their file structure. However, these techniques fail in cases where the file is split into several fragments, especially if some of the fragments were overwritten. In this paper, we present a method for identification and recovery process of video fragments if the video Codec specifications were overwritten. It consists of two parts which are detector and validators. The detector looks for sequences of bytes that could be video fragments in forensics image. The validator decides to accept or reject that a given fragment is a part of a video file. Based on the proposed method we implement a prototype which is called VidCarve. We have conducted several experiments to evaluate the proposed method with current video carving tools. Experimental results show that the discussed method can identify video fragments with high rates of precision and recall. The overall performance rate can produce forensically sound evidence and play a vital role in the process of recovery of digital evidence in many criminal cases.

Impact and Reach

Statistics

Downloads
Activity Overview
308Downloads
62Hits

Additional statistics for this dataset are available via IRStats2.

Altmetric

Actions (login required)

Edit Item Edit Item