Search

In the digital forensic, recovery of deleted and damaged video files play an important role in searching for the evidences. In this paper, MP4-Karver tool is proposed to recover and repair the corrupted videos. Moreover, MP4-Karver extracts frames from video for automatically screen-video to detect illegal cases instead of targeting or watching complete video. Therefore, many existing approaches such as Scalpel’s method, Garfienkel, Bi-Fragment Gap Carving, Smart Carving and Frame Based Recovery attempts to recover the videos in different ways, but most of the recovered videos are usually not complete playable. The proposed MP4-Karver focuses on recovery of video files and repair corrupted videos to complete and playable. Experimental results show that the proposed MP4-Karver effectively restores corrupted or damaged video for an improved percentage of the video restoration compared with existing tools.

Mobile forensics is an exciting new field of research. An increasing number of Open source and commercial digital forensics tools are focusing on less time during digital forensic examination. There is a major issue affecting some mobile forensic tools that allow the tools to spend much time during the forensic examination. It is caused by implementation of poor file searching algorithms by some forensic tool developers. This research is focusing on reducing the time taken to search for a file by proposing a novel, multi-pattern signature matching algorithm called M-Aho-Corasick which is adapted from the original Aho-Corasick algorithm. Experiments are conducted on five different datasets which one of the data sets is obtained from Digital Forensic Research Workshop (DFRWS 2010). Comparisons are made between M-Aho-Corasick using M_Triage with Dec0de, Lifter, XRY, and Xaver. The result shows that M-Aho-Corasick using M_Triage has reduced the searching time by 75% as compared to Dec0de, 36% as compared to Lifter, 28% as compared to XRY, and 71% as compared to Xaver. Thus, M-Aho-Corasick using M_Triage tool is more efficient than Dec0de, Lifter, XRY, and Xaver in avoiding the extraction of high number of false positive results.