Carving Linearly JPEG Images Using Unique Hex Patterns (UHP)

  • Nurul Azma AbdullahEmail author
  • Rosziati Ibrahim
  • Kamaruddin Malik Mohamad
  • Norhamreeza Abdul Hamid
Conference paper
Part of the Lecture Notes in Electrical Engineering book series (LNEE, volume 285)


Many studies have been conducted in addressing problem of fragmented JPEG. However, there are many scenarios in fragmentation yet to be solved. This paper is discussing of using pattern matching to identify single linear fragmented JPEG images. The main contribution of this paper is introducing Unique Hex Patterns (UHP) to carve single linear fragmented JPEG images.


JPEG image Pattern matching File carving DFRWS 2006/07 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.



The authors would like to thank Ministry of Science, Technology and Innovation (MOSTI), for granting Science Fund (Vote s019) to support this research.


  1. 1.
    S. L. Garfinkel, “Digital Forensic Research :The next 10 years,” Digital Investigation, vol. 7(1), 2010, pp. S64-S73.Google Scholar
  2. 2.
    M. I. Cohen, “Advanced Carving Techniques,” Digital Investigation, vol. 4(1-4), 2007, pp. 119-128.Google Scholar
  3. 3.
    S. L. Garfinkel, “Carving Contiguous and Fragmented Files with Fast Object Validation,” Digital Investigation, vol. 4(1), 2007, pp. S2-S12.Google Scholar
  4. 4.
    S. J. J. Kloet, Measuring and Improving the Quality of File Carving Methods, Master Thesis, Endhoven University of Technology, 2007.Google Scholar
  5. 5.
    C. J. Veenman, Statistical Disk Cluster Classification for FIle Carving. Proc. of the Third International Symposium on Information Assurance and Security, Machester, 2007.Google Scholar
  6. 6.
    K. M. Mohamad, M. Mat Deris, Fragmentation Point Detection of JPEG Images at DHT Using Validator. Proc. of the 2009 FGIT, 2009, pp.173-180.Google Scholar
  7. 7.
    A., Pal, & N. Memon, “Automated reassembly of the file fragmented images using greedy algorithms,” IEEE Trans. Image Processing, vol. 15(2), pp. 385-393, 2003.Google Scholar
  8. 8.
    M. Karresand, & N. Shahmehri, Reassembly of fragmented jpeg images containing restart markers. in 2008 European conference on computer network defense, 2008.Google Scholar
  9. 9.
    The International Telegraph and Telephone Consultative Committee (CCITT). Information technology—digital compression and coding of continuous-tone still images–requirements and guideline (ITU-T T.81), 1992. Retrieved Sept. 5, 2012, from World Wide Web Consortium (W3C):
  10. 10.
    S. Bettelli, “ The structure of JPEG pictures,” 2006. Retrieved Sept. 5, 2012 from :
  11. 11.
    Pal, J. T. Sencar, & N. Memon, “Detecting File Fragmentation Point Using Sequential Hypothesis Testing,” Digital Investigation,vol. 5, 2008, pp. S2-S13 2008.Google Scholar
  12. 12.
    K. M. Mohamad, & M. Mat Deris, Visualization of JPEG metadata. in: Proceeding of the 2009 first International Visual Informatics Conference on Visual Informatics,2009.Google Scholar
  13. 13.
    P. Alvarez, “Using extended file information (exif) file headers in digital evidence analysis,” International Journal of Digital Evidence. Vol. 2(3), 2004.Google Scholar
  14. 14.
    K.M. Mohamad, A. Patel, T. Herawan, & M. Mat Deris, “myKarve: JPEG image and thumbnail carver,” Journal of Digital Forensic Practice, vol. 3, 2011, pp. 74-97.Google Scholar
  15. 15.
    N. A. Abdullah, R. Ibrahim, & K. M. Mohamad, Cluster size determination using JPEG files. in Proceedings of the 12th international conference on Computational Science and Its Applications, 2012.Google Scholar
  16. 16.
    S. W. Ng, “Advances in Disk Technology: Performance Issues,” Computer, vol. 31,1998, pp. 75-81.Google Scholar
  17. 17.
  18. 18.
    R. P. Jemigan & S. D. Quinn, Two-Pass Defragmentation of Compressed Hard Disk Data with a Single Data Rewrite. U.S Patent 5574907 .Google Scholar
  19. 19.
    Cluster Size for NTFS, FAT, and ExFAT,
  20. 20.
    N. A. Abdullah, R. Ibrahim & K. M. Mohamad, “ Carving Thumbnail/s and Embedded JPEG Files Using Image Pattern Matching, “ JSEA, vol. 6, 2013, pp. 62-66.Google Scholar

Copyright information

© Springer Science+Business Media Singapore 2014

Authors and Affiliations

  • Nurul Azma Abdullah
    • 1
    Email author
  • Rosziati Ibrahim
    • 1
  • Kamaruddin Malik Mohamad
    • 1
  • Norhamreeza Abdul Hamid
    • 1
  1. 1.Faculty of Computer Science and Information TechnologyUniversiti Tun Hussein Onn MalaysiaBatu PahatMalaysia

Personalised recommendations