Data fragment forensics for embedded DVR systems

Jungheum Park, Sangjin Lee

Research output: Contribution to journalArticle

4 Citations (Scopus)

Abstract

A recent increase in the prevalence of embedded systems has led them to become a primary target of digital forensic investigations. Embedded systems with DVR (Digital Video Recorder) capabilities are able to generate multimedia (video/audio) data, and can act as vital pieces of evidence in the field of digital forensics. To counter anti-forensics, it is necessary to derive systematic forensic techniques that can be used on data fragments in unused (unallocated) areas of files or images. Specifically, the techniques should extract meaningful information from various types of data fragments, such as non-sequential fragmentation and missing fragments overwritten by other data. This paper proposes a new digital forensic system for use on video data fragments related to DVRs. We demonstrate in detail special techniques for the classification, reassembly, and extraction of video data fragments, and introduce an integrated framework for data fragment forensics based on techniques described in this paper.

Original languageEnglish
Pages (from-to)187-200
Number of pages14
JournalDigital Investigation
Volume11
Issue number3
DOIs
Publication statusPublished - 2014 Jan 1

Fingerprint

Multimedia
video
Embedded systems
Digital forensics
fragmentation
multimedia
evidence

Keywords

  • CCTV
  • Data fragment forensics
  • Data fragmentation
  • Digital forensics
  • DVR
  • Unused area
  • Vehicle black box

ASJC Scopus subject areas

  • Law
  • Computer Science Applications
  • Medical Laboratory Technology

Cite this

Data fragment forensics for embedded DVR systems. / Park, Jungheum; Lee, Sangjin.

In: Digital Investigation, Vol. 11, No. 3, 01.01.2014, p. 187-200.

Research output: Contribution to journalArticle

Park, Jungheum ; Lee, Sangjin. / Data fragment forensics for embedded DVR systems. In: Digital Investigation. 2014 ; Vol. 11, No. 3. pp. 187-200.
@article{097eb85228ba4fb3973b6dd43dfcf75b,
title = "Data fragment forensics for embedded DVR systems",
abstract = "A recent increase in the prevalence of embedded systems has led them to become a primary target of digital forensic investigations. Embedded systems with DVR (Digital Video Recorder) capabilities are able to generate multimedia (video/audio) data, and can act as vital pieces of evidence in the field of digital forensics. To counter anti-forensics, it is necessary to derive systematic forensic techniques that can be used on data fragments in unused (unallocated) areas of files or images. Specifically, the techniques should extract meaningful information from various types of data fragments, such as non-sequential fragmentation and missing fragments overwritten by other data. This paper proposes a new digital forensic system for use on video data fragments related to DVRs. We demonstrate in detail special techniques for the classification, reassembly, and extraction of video data fragments, and introduce an integrated framework for data fragment forensics based on techniques described in this paper.",
keywords = "CCTV, Data fragment forensics, Data fragmentation, Digital forensics, DVR, Unused area, Vehicle black box",
author = "Jungheum Park and Sangjin Lee",
year = "2014",
month = "1",
day = "1",
doi = "10.1016/j.diin.2014.06.001",
language = "English",
volume = "11",
pages = "187--200",
journal = "Digital Investigation",
issn = "1742-2876",
publisher = "Elsevier Limited",
number = "3",

}

TY - JOUR

T1 - Data fragment forensics for embedded DVR systems

AU - Park, Jungheum

AU - Lee, Sangjin

PY - 2014/1/1

Y1 - 2014/1/1

N2 - A recent increase in the prevalence of embedded systems has led them to become a primary target of digital forensic investigations. Embedded systems with DVR (Digital Video Recorder) capabilities are able to generate multimedia (video/audio) data, and can act as vital pieces of evidence in the field of digital forensics. To counter anti-forensics, it is necessary to derive systematic forensic techniques that can be used on data fragments in unused (unallocated) areas of files or images. Specifically, the techniques should extract meaningful information from various types of data fragments, such as non-sequential fragmentation and missing fragments overwritten by other data. This paper proposes a new digital forensic system for use on video data fragments related to DVRs. We demonstrate in detail special techniques for the classification, reassembly, and extraction of video data fragments, and introduce an integrated framework for data fragment forensics based on techniques described in this paper.

AB - A recent increase in the prevalence of embedded systems has led them to become a primary target of digital forensic investigations. Embedded systems with DVR (Digital Video Recorder) capabilities are able to generate multimedia (video/audio) data, and can act as vital pieces of evidence in the field of digital forensics. To counter anti-forensics, it is necessary to derive systematic forensic techniques that can be used on data fragments in unused (unallocated) areas of files or images. Specifically, the techniques should extract meaningful information from various types of data fragments, such as non-sequential fragmentation and missing fragments overwritten by other data. This paper proposes a new digital forensic system for use on video data fragments related to DVRs. We demonstrate in detail special techniques for the classification, reassembly, and extraction of video data fragments, and introduce an integrated framework for data fragment forensics based on techniques described in this paper.

KW - CCTV

KW - Data fragment forensics

KW - Data fragmentation

KW - Digital forensics

KW - DVR

KW - Unused area

KW - Vehicle black box

UR - http://www.scopus.com/inward/record.url?scp=84908252080&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84908252080&partnerID=8YFLogxK

U2 - 10.1016/j.diin.2014.06.001

DO - 10.1016/j.diin.2014.06.001

M3 - Article

AN - SCOPUS:84908252080

VL - 11

SP - 187

EP - 200

JO - Digital Investigation

JF - Digital Investigation

SN - 1742-2876

IS - 3

ER -