Image fragment carving based on DCT semantics and an adjustment factor

Abstract

The recovery of evidence from fragmented image files is a prominent research focus in the field of file carving. To address image fragment reassembly, this paper analyzes the Joint Photographic Experts Group (JPEG) image structure and proposes a fragment connection weighting algorithm based on discrete cosine transform (DCT) semantic features, along with a weight adjustment factor that leverages image compression characteristics. By integrating these components, the algorithm effectively determines the fragment sequence in JPEG files, and a practical carving algorithm is designed. Experiments conducted on disk and memory demonstrate that the adjustment factor-based algorithm outperforms the DCT-only method in identifying true best matches (reducing false positives). Disk experiments achieve an average carving precision of 94.4%, surpassing existing methods, while memory experiments validate the feasibility of the approach, along with a theoretical analysis of failure scenarios caused by interference from software such as Windows Photo Viewer.

Keywords

Discrete cosine transform / Fragmented image files / Memory media

References

[1] Ali RR , Mohamad KM , Jamel S , et al., 2018. A review of digital forensics methods for JPEG file carving. J Theor Appl Inform Technol, 96(17): 5841- 5856.

[2] Azhan NAN , Ikuesan RA , Razak SA , et al., 2022.. Error level analysis technique for identifying JPEG block unique signature for digital forensic analysis. Electronics, 11 (9): 1468.

[3] Bharati MH , Liu JJ , Macgregor JF , 2004.. Image texture analysis:methods and comparisons. Chemometr Intell Lab Syst, 72 (1): 57- 71.

[4] Dabbaghchian S , Ghaemmaghami MP , Aghagolzadeh A , 2010.. Feature extraction using discrete cosine transform and discrimination power analysis with a face recognition technology. Patt Recogn, 43 (4): 1431- 1440.

[5] de Bock J , de Smet P , 2015.. JPGcarve:an advanced tool for automated recovery of fragmented JPEG files. IEEE Trans Inform Forens Sec, 11 (1): 19- 34.

[6] Durmus E , Mohanty M , Taspinar S , et al., 2017. Image carving with missing headers and missing fragments. IEEE Int Workshop on Information Forensics and Security, p.1-6.

[7] Ferreira WD , Ferreira CBR , da Cruz Júnior G , et al., 2020. A review of digital image forensics. Comput Electron Eng, 85:106685.

[8] Garfinkel SL , 2007.. Carving contiguous and fragmented files with fast object validation. Dig Invest, 4: 2- 12.

[9] Guzhov A , Wirth CT , 2025. Transformer-based file fragment type classification for file carving in digital forensics. 24^th European Conf on Cyber Warfare and Security, p.169-176.

[10] Karresand M , Shahmehri N , 2008. Reassembly of fragmented JPEG images containing restart markers. European Conf on Computer Network Defense, p.1-8.

[11] Kornblum JD , 2008.. Using JPEG quantization tables to identify imagery processed by software. Dig Invest, 5: S21- S25.

[12] Li BL , Zhou Z , Zhang Y , et al., 2021.. Memory fragment file carving algorithm based on the reverse of the structure chain. J Commun, 42: 117- 127 (in Chinese).

[13] Li Q , Sahin B , Chang EC , et al., 2011. Content based JPEG fragmentation point detection. IEEE Int Conf on Multimedia and Expo, p.1-6.

[14] Lu J , Liang Y , Han H , et al., 2025.. A survey on computational solutions for reconstructing complete objects by reassembling their fractured parts. Comput Graph Forum, 44 (2): e70081.

[15] Memon N , Pal A , 2006.. Automated reassembly of file fragmented images using greedy algorithms. IEEE Trans Image Process, 15 (2): 385- 393.

[16] Mohamad KM , Deris MM , 2009. Fragmentation point detection of JPEG images at DHT using validator. Int Conf on Future Generation Information Technology, p.173-180.

[17] Mullan P , Riess C , Freiling F , 2019.. Forensic source identification using JPEG image headers:the case of smartphones. Dig Invest, 28: S68- S76.

[18] Pal A , Sencar HT , Memon N , 2008.. Detecting file fragmentation point using sequential hypothesis testing. Dig Invest, 5: S2- S13.

[19]

[20] Ramli NIS , Hisham SI , Razak MFA , 2021b. Survey of file carving techniques. Int Conf of Reliable Information and Communication Technology, p.815-825.

[21] Richard GGIII , Roussev V , 2005. Scalpel:a frugal, high performance file carver. 5^th Annual Digital Forensic Research Workshop, p.1-10.

[22] Sencar HT , Memon N , 2009.. Identification and recovery of JPEG files with missing fragments. Dig Invest, 6: S88- S98.

[23] Shanmugasundaram K , Memon N , 2003. Automatic reassembly of document fragments via context based statistical models. 19^th Annual Computer Security Applications Conf, p.152-159.

[24] Shi Z , Zheng H , Xu C , et al., 2023. Resfusion:denoising diffusion probabilistic models for image restoration based on prior residual noise. Proc Int Conf on Neural Information Processing Systems, p.130664-130693.

[25] Singh S , Gupta VK , 2023.. JPEG image compression and decompression by Huffman coding. Int J Innov Sci Res Technol, 1 (5): 8- 14.

[26] Tang Y , Fang J , Chow KP , et al., 2016.. Recovery of heavily fragmented JPEG files. Dig Invest, 18: S108- S117.

[27] Uzun E , Sencar HT , 2020.. JpgScraper:an advanced carver for JPEG files. IEEE Trans Inform Forens Sec, 15: 1846- 1857.

[28] van Baar RB , Alink W , van Ballegooij A , 2008.. Forensic memory analysis:files mapped in memory. Dig Invest, 5: S52- S57.

[29] Wu X , Han Q , Niu X , et al., 2018.. JPEG image width estimation for file carving. IET Image Process, 12 (7): 1245- 1252.

[30] Wu X , Han Q , Niu X , et al., 2019.. Novel similarity measurements for reassembling fragmented image files. Chin J Electron, 28 (2): 331- 337.

Rights & permissions

The Authors. Published by Zhejiang University Press Co., Ltd.