Yannikos, York and Ashraf, Muhammad-Nadeen and Steinebach, Martin and Winter, Christian Peterson, Gilbert and Shenoi, Sujeet (eds.) (2013):
Automation of Video File Carving and Content Identification.
In: IFIP Advances in Information and Communication Technology, 410, In: Advances in Digital Forensics IX – 9th IFIP WG 11.9 International Conference on Digital Forensics, Orlando, Florida, USA, January 28–30, 2013, Revised Selected Papers, pp. 195–212,
Springer, USA, Florida, Orlando, National Center for Forensic Science, ISBN 978-3-642-41147-2,
[Conference or Workshop Item]

Abstract

The amount of data distributed within the Internet steadily increases -- so does the amount of illegal content, especially illegal image and video data. Therefore, the capability of automatically recovering and analyzing multimedia data from seized storage devices is crucial for forensic investigators. However, most forensic analysis processes are still done manually or require continuous interaction, e.g. applying content recovery and a subsequent content identification. Especially the identification of illegal content during an investigation is very time-consuming since no reliable tools for automatic content classification of found multimedia data exist for practical use. Additionally, current multimedia file carvers are often not robust enough, e.g. recovering single frames of video files where some data is corrupted or missing is often not possible. Hence, evidence data or exonerating content may be overlooked. Altogether, more robust tools and more automation is required for thorough forensic analyses.

In this work we summarize the state of the art in video file carving. Furthermore, we propose combining the two forensic techniques -- video file carving and robust hashing -- to a single procedure which can be used for the automated recovery and identification of video content. Applying this procedure allows forensic investigators an automated search and recovery of video content such as single video frames as well as an automated matching of findings against reference data sets, e.g. hash databases indexing illegal content. Thus our procedure helps speeding up forensic investigation processes significantly.

Send an inquiry

Show editorial Details