Automating Video File Carving and Content Identification

The massive amount of illegal content, especially images and videos, encountered in forensic investigations requires the development of tools that can automatically recover and analyze multimedia data from seized storage devices. However, most forensic analysis processes are still done manually or require continuous human interaction. The identification of illegal content is particularly time consuming because no reliable tools for automatic content classification are currently available. Additionally, multimedia file carvers are often not robust enough – recovering single frames of video files is often not possible if some of the data is corrupted or missing. This paper proposes the combination of two forensic techniques – video file carving and robust hashing – in a single procedure that can be used for the automated recovery and identification of video content, significantly speeding up forensic investigations.