Kamaruddin Malik Mohamad

Fragmentation Point Detection of JPEG Images at DHT Using Validator

File carving is an important, practical technique for data recovery in digital forensics investigation and is particularly useful when filesystem metadata is unavailable or damaged. The research on reassembly of JPEG files with RST markers, fragmented within the scan area have been done before. However, fragmentation within Define Huffman Table (DHT) segment is yet to be resolved. This paper analyzes the fragmentation within the DHT area and list out all the fragmentation possibilities. Two main contributions are made in this paper. Firstly, three fragmentation points within DHT area are listed. Secondly, few novel validators are proposed to detect these fragmentations. The result obtained from tests done on manually fragmented JPEG files, showed that all three fragmentation points within DHT are successfully detected using validators.

Anti-cropping digital image watermarking using Sudoku

Many digital image watermarking schemes have been developed to embed copyright information into an image. However, an attacker may reuse parts of a watermarked image by cropping out unwanted parts. Several techniques have been designed to overcome this attack but due to their limited redundancy approach, some section of the images can still be retrieved without detectable watermark. In this paper, a new watermarking scheme that is robust against severe cropping using Sudoku is proposed. It is based on Sudokus permutation property that allows evenly distributed copies of watermark pieces in all parts of the cover image. A valid Sudoku solution is used during the embedding as well as during the detection of the watermark. Using classic 9 × 9 Sudoku, the scheme demonstrated robustness of up to 94% of random cropping.

Single-byte-marker for Detecting JPEG JFIF Header Using FORIMAGE-JPEG

Header and footer detection is important in digital investigation for file type detection. The use of efficient algorithm to detect them is vital to reduce time taken for analyzing ever increasing data in hard drive or physical memory. Even though there are few applications developed e.g.Foremost, Scalpel; however the algorithm used for header detection is not discussed much. This paper introduces two algorithms: single-byte-marker and 20-point-reference for header detection. Few experiments have been done using image taken from Helix Live CD from 8MB hard disk partition, 1GBphysical memory and raw data from DFRWS 2006 challenge.The results show that single-byte-marker algorithm is more efficient for header detection.

Cluster size determination using JPEG files

File can be recovered by simply using traditional recovery means. However, a technique is required to distinguish one file to another when dealing with hard disk with corrupted filesystem metadata. As in a computer file system, a cluster is the smallest allocation of disk space to hold a file, information about the cluster size can help in determining the start of file which can be used to distinguish one file to another. This paper introduces a method for acquiring the cluster size by using data sets from DFRWS 2006 and DFRWS 2007. A tool called PredClus is developed to automatically display the predicted cluster size according to probabilistic percentage. By using PredClus, the cluster size used in both DFRWS 2006 and DFRWS 2007 can be determined. Thus, JPEG images that are not located at the starting address of any cluster are most probably thumbnails or embedded files.

Carving JPEG images and thumbnails using image pattern matching

Digital forensics is a branch of forensic science to monitor, analyze and examine digital media or devices. File carving is the art of recovering files from digital data storage with corrupted or unavailable file system metadata and it is very useful in a digital forensics investigation. However, earlier generation file carver like Scalpel and Foremost only deals with non-fragmented files. We proposed an automatic image and thumbnail carving tool called myKarve which is useful in digital forensics investigation and presentation of evidential information that is able to carve contiguous and linearly fragmented images caused by garbage. myKarve is designed on a new architecture to deal with thumbnail and fragmentation issues. The tool is tested with images obtained from the Internet. myKarve is found to be a more efficient automated image and thumbnail carver compared to the original Scalpel with the following advantages: detects more headers using validated headers; carves more images and thumbnails by using the newly introduced image patterns; and is able to discard garbage from linearly fragmented images. The results from myKarve are invaluable in the field work of digital forensic analysis that can produce technical evidence against cybercrime activities to prosecution cases.

Visualization of JPEG Metadata

There are a lot of information embedded in JPEG image than just graphics. Visualization of its metadata would benefit digital forensic investigator to view embedded data including corrupted image where no graphics can be displayed in order to assist in evidence collection for cases such as child pornography or steganography. There are already available tools such as metadata readers, editors and extraction tools but mostly focusing on visualizing attribute information of JPEG Exif. However, none have been done to visualize metadata by consolidating markers summary, header structure, Huffman table and quantization table in a single program. In this paper, metadata visualization is done by developing a program that able to summarize all existing markers, header structure, Huffman table and quantization table in JPEG. The result shows that visualization of metadata helps viewing the hidden information within JPEG more easily.

Dual-Byte-Marker Algorithm for Detecting JFIF Header

The use of efficient algorithm to detect JPEG file is vital to reduce time taken for analyzing ever increasing data in hard drive or physical memory. In the previous paper, single-byte-marker algorithm is proposed for header detection. In this paper, another novel header detection algorithm called dual-byte-marker is proposed. Based on the experiments done on images from hard disk, physical memory and data set from DFRWS 2006 Challenge, results showed that dual-byte-marker algorithm gives better performance with better execution time for header detection as compared to single-byte-marker.

Hiding Data in JPEG Using in-DQT Technique

Steganography techniques are useful to convey hidden information using various types of typically-transmitted multimedia data as cover file to conceal communication. When using JPEG as a cover file, normally message is hidden in the AC values of quantized DCT coefficients. However, concealment of message in quantization table is yet to be done. In this paper, a novel in-DQT technique for message hiding in JPEG’s quantization table using bytewise insertion is proposed. By using in-DQT technique on standard JPEG test images for cover files with up to 24 bytes of message, results show that steganography image with minimal acceptable image distortion. Thus, in-DQT technique provides alternative for embedding message in quantization table.

Carving Linearly JPEG Images Using Unique Hex Patterns (UHP)

Many studies have been conducted in addressing problem of fragmented JPEG. However, there are many scenarios in fragmentation yet to be solved. This paper is discussing of using pattern matching to identify single linear fragmented JPEG images. The main contribution of this paper is introducing Unique Hex Patterns (UHP) to carve single linear fragmented JPEG images.

Classification of JPEG Files by Using Extreme Learning Machine

Recovery of data files when their system information missing is a challenging research issue. The recovery process entails methods that analyze the structure and contents of each individual file clusters. A primary and important process of files’ recovery is determining the files’ types including JPEG, DOC or HTML. This paper proposes an Extreme Learning Machine (ELM) algorithm to assign a class label of JPEG or Non-JPEG image for files in a continuous series of data clusters. The algorithm automatically classifies the files based on evaluation measures of three methods Entropy, Byte Frequency Distribution and Rate of Change. The ELM algorithm is applied to RABEI-2017 and DFRWS-2006 datasets. The experimental results show that the ELM algorithm is able to identify JPEG files of fragmented clusters with high accuracy rate. The classification accuracy of the RABEI-2017 dataset is 90.15% and the DFRWS-2006 is 93.46%. The DFRWS-2006 has more classes than the RABEI-2017 which improves the ELM classifier fitting.