MyKarve

JPEG image and thumbnail carver

kamaruddin Malik mohamad, Ahmed Patel, Tutut Herawan, Mustafa Mat Deris

Research output: Contribution to journalArticle

8 Citations (Scopus)

Abstract

We propose an automatic image and thumbnail carving tool called myKarve, which is useful in digital forensics investigation and presentation of evidential information. It is able to carve contiguous and linearly fragmented images caused by garbage, which is tested against three hypotheses to prove its authenticity. These images fall into three categories: images with one or two thumbnails or none at all; thumbnails with headers that do not follow the standard header patterns; and fragmentations caused by garbage. myKarve is designed on a new framework by extending Scalpel features to deal with thumbnail and fragmentation issues. The Validated Joint Photographic Experts Group (JPEG) Header (VJH) list and Address DataBase (ADB) are used to automatically generate work instructions in a work queue to initiate a fully automated image carving process. A shift-key-matching (SKM) technique is used to detect garbage that causes fragmentation in carved images or thumbnails before it can be cleaned. The tool is tested with Digital Forensics Research Work Shop (DFRWS) 2006 and 2007 data sets and images obtained from the Internet. myKarve is found to be a more efficient automated image and thumbnail carver compared to the original Scalpel with the following advantages: detects more headers using validated headers; carves more images and thumbnails by using the newly introduced image patterns; and is able to discard garbage from linearly fragmented images. The results from myKarve are invaluable in the fieldwork of digital forensic analysis and can produce technical evidence of cybercrime activities.

Original languageEnglish
Pages (from-to)74-97
Number of pages24
JournalJournal of Digital Forensic Practice
Volume3
Issue number2-4
DOIs
Publication statusPublished - 2010
Externally publishedYes

Fingerprint

expert
Group
fragmentation
Internet
Digital forensics
authenticity
instruction
cause
evidence
Fragmentation

Keywords

  • Digital evidence
  • Digital forensic analysis tool
  • Digital forensics
  • File carving
  • File fragmentation
  • Image processing

ASJC Scopus subject areas

  • Law
  • Computer Science Applications
  • Software
  • Information Systems and Management

Cite this

Malik mohamad, K., Patel, A., Herawan, T., & Deris, M. M. (2010). MyKarve: JPEG image and thumbnail carver. Journal of Digital Forensic Practice, 3(2-4), 74-97. https://doi.org/10.1080/15567281.2010.531607

MyKarve : JPEG image and thumbnail carver. / Malik mohamad, kamaruddin; Patel, Ahmed; Herawan, Tutut; Deris, Mustafa Mat.

In: Journal of Digital Forensic Practice, Vol. 3, No. 2-4, 2010, p. 74-97.

Research output: Contribution to journalArticle

Malik mohamad, K, Patel, A, Herawan, T & Deris, MM 2010, 'MyKarve: JPEG image and thumbnail carver', Journal of Digital Forensic Practice, vol. 3, no. 2-4, pp. 74-97. https://doi.org/10.1080/15567281.2010.531607
Malik mohamad, kamaruddin ; Patel, Ahmed ; Herawan, Tutut ; Deris, Mustafa Mat. / MyKarve : JPEG image and thumbnail carver. In: Journal of Digital Forensic Practice. 2010 ; Vol. 3, No. 2-4. pp. 74-97.
@article{fa6166bb86c84c55b9203d1a30aa4c61,
title = "MyKarve: JPEG image and thumbnail carver",
abstract = "We propose an automatic image and thumbnail carving tool called myKarve, which is useful in digital forensics investigation and presentation of evidential information. It is able to carve contiguous and linearly fragmented images caused by garbage, which is tested against three hypotheses to prove its authenticity. These images fall into three categories: images with one or two thumbnails or none at all; thumbnails with headers that do not follow the standard header patterns; and fragmentations caused by garbage. myKarve is designed on a new framework by extending Scalpel features to deal with thumbnail and fragmentation issues. The Validated Joint Photographic Experts Group (JPEG) Header (VJH) list and Address DataBase (ADB) are used to automatically generate work instructions in a work queue to initiate a fully automated image carving process. A shift-key-matching (SKM) technique is used to detect garbage that causes fragmentation in carved images or thumbnails before it can be cleaned. The tool is tested with Digital Forensics Research Work Shop (DFRWS) 2006 and 2007 data sets and images obtained from the Internet. myKarve is found to be a more efficient automated image and thumbnail carver compared to the original Scalpel with the following advantages: detects more headers using validated headers; carves more images and thumbnails by using the newly introduced image patterns; and is able to discard garbage from linearly fragmented images. The results from myKarve are invaluable in the fieldwork of digital forensic analysis and can produce technical evidence of cybercrime activities.",
keywords = "Digital evidence, Digital forensic analysis tool, Digital forensics, File carving, File fragmentation, Image processing",
author = "{Malik mohamad}, kamaruddin and Ahmed Patel and Tutut Herawan and Deris, {Mustafa Mat}",
year = "2010",
doi = "10.1080/15567281.2010.531607",
language = "English",
volume = "3",
pages = "74--97",
journal = "Journal of Digital Forensic Practice",
issn = "1556-7281",
publisher = "Taylor and Francis",
number = "2-4",

}

TY - JOUR

T1 - MyKarve

T2 - JPEG image and thumbnail carver

AU - Malik mohamad, kamaruddin

AU - Patel, Ahmed

AU - Herawan, Tutut

AU - Deris, Mustafa Mat

PY - 2010

Y1 - 2010

N2 - We propose an automatic image and thumbnail carving tool called myKarve, which is useful in digital forensics investigation and presentation of evidential information. It is able to carve contiguous and linearly fragmented images caused by garbage, which is tested against three hypotheses to prove its authenticity. These images fall into three categories: images with one or two thumbnails or none at all; thumbnails with headers that do not follow the standard header patterns; and fragmentations caused by garbage. myKarve is designed on a new framework by extending Scalpel features to deal with thumbnail and fragmentation issues. The Validated Joint Photographic Experts Group (JPEG) Header (VJH) list and Address DataBase (ADB) are used to automatically generate work instructions in a work queue to initiate a fully automated image carving process. A shift-key-matching (SKM) technique is used to detect garbage that causes fragmentation in carved images or thumbnails before it can be cleaned. The tool is tested with Digital Forensics Research Work Shop (DFRWS) 2006 and 2007 data sets and images obtained from the Internet. myKarve is found to be a more efficient automated image and thumbnail carver compared to the original Scalpel with the following advantages: detects more headers using validated headers; carves more images and thumbnails by using the newly introduced image patterns; and is able to discard garbage from linearly fragmented images. The results from myKarve are invaluable in the fieldwork of digital forensic analysis and can produce technical evidence of cybercrime activities.

AB - We propose an automatic image and thumbnail carving tool called myKarve, which is useful in digital forensics investigation and presentation of evidential information. It is able to carve contiguous and linearly fragmented images caused by garbage, which is tested against three hypotheses to prove its authenticity. These images fall into three categories: images with one or two thumbnails or none at all; thumbnails with headers that do not follow the standard header patterns; and fragmentations caused by garbage. myKarve is designed on a new framework by extending Scalpel features to deal with thumbnail and fragmentation issues. The Validated Joint Photographic Experts Group (JPEG) Header (VJH) list and Address DataBase (ADB) are used to automatically generate work instructions in a work queue to initiate a fully automated image carving process. A shift-key-matching (SKM) technique is used to detect garbage that causes fragmentation in carved images or thumbnails before it can be cleaned. The tool is tested with Digital Forensics Research Work Shop (DFRWS) 2006 and 2007 data sets and images obtained from the Internet. myKarve is found to be a more efficient automated image and thumbnail carver compared to the original Scalpel with the following advantages: detects more headers using validated headers; carves more images and thumbnails by using the newly introduced image patterns; and is able to discard garbage from linearly fragmented images. The results from myKarve are invaluable in the fieldwork of digital forensic analysis and can produce technical evidence of cybercrime activities.

KW - Digital evidence

KW - Digital forensic analysis tool

KW - Digital forensics

KW - File carving

KW - File fragmentation

KW - Image processing

UR - http://www.scopus.com/inward/record.url?scp=79955460085&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=79955460085&partnerID=8YFLogxK

U2 - 10.1080/15567281.2010.531607

DO - 10.1080/15567281.2010.531607

M3 - Article

VL - 3

SP - 74

EP - 97

JO - Journal of Digital Forensic Practice

JF - Journal of Digital Forensic Practice

SN - 1556-7281

IS - 2-4

ER -