Abstract
File can be recovered by simply using traditional recovery means. However, a technique is required to distinguish one file to another when dealing with hard disk with corrupted filesystem metadata. As in a computer file system, a cluster is the smallest allocation of disk space to hold a file, information about the cluster size can help in determining the start of file which can be used to distinguish one file to another. This paper introduces a method for acquiring the cluster size by using data sets from DFRWS 2006 and DFRWS 2007. A tool called PredClus is developed to automatically display the predicted cluster size according to probabilistic percentage. By using PredClus, the cluster size used in both DFRWS 2006 and DFRWS 2007 can be determined. Thus, JPEG images that are not located at the starting address of any cluster are most probably thumbnails or embedded files.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Ng, S.W.: Advances in Disk Technology: Performance Issues. Computer 31, 75–81 (1998)
File Allocation Table, http://en.wikipedia.org/wiki/File_Allocation_Table#Boot_Sector
Jemigan, R.P., Quinn, S.D.: Two-Pass Defragmentation of Compressed Hard Disk Data with a Single Data Rewrite. U.S Patent 5574907
Mkfs.xfs(8)-Linux Man Page, http://linux.die.net/man/8/mkfs.xfs
Data Cluster, http://en.wikipedia.org/wiki/Data_cluster
The Default Cluster Size for the NTFS and FAT File Systems, http://support.microsoft.com/kb/314878
Default Cluster Size for NTFS, FAT, and ExFAT, http://support.microsoft.com/kb/140365
Linux System Administrator Guide: Chapter 5: Using Disks and Other Storage Media, http://tldp.org/LDP/sag/html/filesystems.html
Vista/XP Install on Large Cluster Sizes, http://www.winvistatips.com/vista-xp-install-large-cluster-sizes-t801412.html
Digital Forensics Research Workshop (DFRWS), http://www.dfrws.org/2006/challenge/submission.shtml
Digital Forensics Research Workshop (DFRWS), http://www.dfrws.org/2007/challenge/submission.shtml
Mohamad, K.M., Mat Deris, M.: Single-byte-marker for Detecting JPEG JFIF Header using FIRIMAGE-JPEG. In: Proc. of the 2009 Fifth International Joint Conference on INC, IMS and IDC, 2009, pp. 1693–1698 (2009)
Mohamad, K.M., Herawan, T., Deris, M.M.: Dual-Byte-Marker Algorithm for Detecting JFIF Header. In: Bandyopadhyay, S.K., Adi, W., Kim, T.-h., Xiao, Y. (eds.) ISA 2010. CCIS, vol. 76, pp. 17–26. Springer, Heidelberg (2010)
Mohamad, K.M., Mat Deris, M.: Fragmentation Point Detection of JPEG Images at DHT Using Validator. In: Proc. of the 2009 FGIT, pp.173–180 (2009)
Mohamad, K.M., Patel, A., Herawan, T., Mat Deris, M.: myKarve: Jpeg Image And Thumbnail Carver. Journal of Digital Forensic Practice 3, 74–97 (2010)
Cohen, M.I.: Advanced Carving Techniques. Digital Investigation 4(1-4), 119–128 (2007)
Metz, J., Mora, R.J.: Analysis of 2006 DFRWS Forensic Carving Challenge, http://sandbox.dfrws.org/2006/mora/dfrws2006.pdf
Richard III, G.G., Roussev, V.: Scalpel: A Frugal, High Performance File Carver. In: Proc. of the 2005 Digital Forensics Research Workshop, New Orleans (2005)
McKusick, M.K., Joy, W.N., Leffler, S.J., Fabry, R.S.: A Fast File System for UNIX. ACM Transactions on Computer Systems 2 (1984)
Kanagawa, S.K.: Information Reproduction Apparatus and Information Reproduction Method. U.S. Patent 6,236,663 BI
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Abdullah, N.A., Ibrahim, R., Mohamad, K.M. (2012). Cluster Size Determination Using JPEG Files. In: Murgante, B., et al. Computational Science and Its Applications – ICCSA 2012. ICCSA 2012. Lecture Notes in Computer Science, vol 7336. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-31128-4_26
Download citation
DOI: https://doi.org/10.1007/978-3-642-31128-4_26
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-31127-7
Online ISBN: 978-3-642-31128-4
eBook Packages: Computer ScienceComputer Science (R0)