Smart-carving : recovering deleted JPEG files

Abstract

File carving is the technique that can recover files independently from any file system metadata. By thoroughly analysing the structure and contents of the raw binary data, file carving is the only remedy for recovering deleted files from digital media. Due to file fragmentation and encoded file formats, file carving is a complex and highly problematic process. This work presents a smart carving technique which iteratively tries to recover deleted JPEG files. This method exploits the syntax and semantics of JPEG images to ensure that the carved files are correctly recovered. The interplay between these two analyses is proposed to validate the encoded JPEG file structure and to verify whether the carved JPEG files are free from any distorted image regions. The evaluation of the proposed method shows that it can recover 100% of the recoverable JPEG files found in a real-world memory card and 93% of the JPEG files found in a hand-crafted test set. Moreover, the method showed that it is competitive with current open-source and proprietary file carving tools.