JPGcarve: An Advanced Tool for Automated Recovery of Fragmented JPEG Files

In this paper, we present a new tool for forensic recovery of single and multi-fragment JPEG/JFIF data files. First, we discuss the basic design and the technical methods composing our proposed data carving algorithm. Next, we compare the performance of our method with the well-known Adroit Photo Forensics (APF) state-of-the art tool. This comparison is centered on both the carving results as well as the obtained data processing speed, and is evaluated in terms of the results that can be obtained for several well-known reference data sets. Important to note is that we specifically focus on the fundamental recovery and fragment matching performance of the tools by forcing them to use various assumed cluster sizes. We show that on all accounts our new tool can significantly outperform APF. This improvement in data processing speed and carving results can be mostly attributed to novel methods to iterate and reduce the data search space and to a novel parameterless method to determine the end of a fragment based on the pixel data. Finally, we discuss several options for future research.