Image content analysis for sector-wise JPEG fragment classification

In this paper, we propose a sector-wise JPEG fragment classification approach to classify normal and erroneous JPEG data fragments with the minimum size of 512 bytes per fragment. Our method is based on processing each read-in sector of 512 bytes with using the DCT coefficient analysis methods for extracting the features of visual inconsistencies. The classification is conducted before the inverse DCT and can be performed simultaneously with JPEG decoding. The contributions of this work are two-folds: (1) a sector-wise JPEG erroneous fragment classification approach is proposed (2) new DCT coefficient analysis methods are introduced for image content analysis. Testing results on a variety of erroneous fragmented and normal JPEG files prove the strength of this operator for the purpose of forensics analysis, data recovery and abnormal fragment inconsistencies classification and detection. Furthermore, the results also show that the proposed DCT coefficient analysis methods are efficient and practical in terms of classification accuracy. In our experiment, the proposed approach yields a false positive rate of 0.32% and a true positive rate of 96.1% in terms of erroneous JPEG fragment classification.

[1]  Ying,et al.  Design and Analysis of Inequalitybased Fragmented File Carving Algorithms , 2010 .

[2]  Simson L. Garfinkel,et al.  Disk Imaging with the Advanced Forensic Format , Library and Tools , 2006 .

[3]  Chih-Jen Lin,et al.  LIBSVM: A library for support vector machines , 2011, TIST.

[4]  Vrizlynn L. L. Thing,et al.  A Novel Inequality-Based Fragmented File Carving Technique , 2010, e-Forensics.

[5]  N. Memon,et al.  The evolution of file carving , 2009, IEEE Signal Processing Magazine.

[6]  Nasir D. Memon,et al.  Automated reassembly of file fragmented images using greedy algorithms , 2006, IEEE Transactions on Image Processing.

[7]  Michael I. Cohen,et al.  Advanced JPEG carving , 2008, e-Forensics '08.

[9]  Vrizlynn L. L. Thing,et al.  Design of a Digital Forensics Evidence Reconstruction System for Complex and Obscure Fragmented File Carving , 2011, 2011 Seventh International Conference on Computational Intelligence and Security.

[10]  Husrev T. Sencar,et al.  Detecting file fragmentation point using sequential hypothesis testing , 2008, Digit. Investig..

[11]  Vrizlynn L. L. Thing,et al.  Optimal Path Construction for Fragmented File Carving , 2010, SAISMC.

[12]  Vrizlynn L. L. Thing,et al.  Content based JPEG fragmentation point detection , 2011, 2011 IEEE International Conference on Multimedia and Expo.

[13]  Chih-Jen Lin,et al.  Combining SVMs with Various Feature Selection Strategies , 2006, Feature Extraction.

[14]  William J. Bolosky,et al.  A large-scale study of file-system contents , 1999, SIGMETRICS '99.

[15]  Ting Wang,et al.  Application of Breiman's Random Forest to Modeling Structure-Activity Relationships of Pharmaceutical Molecules , 2004, Multiple Classifier Systems.