Image fragment carving based on DCT semantics and an adjustment factor

Abstract

The recovery of evidence from fragmented image files is a prominent research focus in the field of file carving. To address image fragment reassembly, this paper analyzes the Joint Photographic Experts Group (JPEG) image structure and proposes a fragment connection weighting algorithm based on discrete cosine transform (DCT) semantic features, along with a weight adjustment factor that leverages image compression characteristics. By integrating these components, the algorithm effectively determines the fragment sequence in JPEG files, and a practical carving algorithm is designed. Experiments conducted on disk and memory demonstrate that the adjustment factor-based algorithm outperforms the DCT-only method in identifying true best matches (reducing false positives). Disk experiments achieve an average carving precision of 94.4%, surpassing existing methods, while memory experiments validate the feasibility of the approach, along with a theoretical analysis of failure scenarios caused by interference from software such as Windows Photo Viewer.

1. Introduction

File carving is an important technique for evidence extraction in digital crime forensic investigations (Ramli et al., 2021b; Guzhov and Wirth, 2025; Lu et al., 2025). However, due to the inherent block-based storage characteristics of hard disk media, file operations such as addition, deletion, and modification can easily lead to file fragmentation, posing significant challenges for evidence recovery. With the development of anti-forensic techniques, digital criminals often conceal evidence by deleting files or even storing them in fragmented forms before law enforcement personnel can obtain image file evidence, thereby exacerbating the degree of file fragmentation on hard disk storage media. Additionally, memory forensics technology is receiving increasing attention because physical memory contains a large amount of digital crime evidence, and research indicates that data fragmentation in memory is even more severe than on disk (van Baar et al., 2008). In digital forensic investigations, it is necessary to find different types of crime-related evidence, such as emails, documents, system logs, and multimedia image files, from both disk media and memory media. Among these, the extraction of evidence from fragmented image files is currently a hot research topic in the field of fragmented file carving (Ali et al., 2018; Mullan et al., 2019; Ferreira et al., 2020; Shi et al., 2023).

Currently, several fragment carving methods have been proposed to extract fragmented image files from disk storage media (Ramli et al., 2021a). The key to image fragment carving methods is the fragment connection weighting algorithm, and most of the current fragment connection weighting algorithms, such as sum of differences (SoD) and Euclidean distance (ED), focus on using the color difference between boundary pixels to determine the best candidate fragment (Tang et al., 2016; Wu et al., 2019). These methods have limitations: the minimum color difference between fragments only indicates the weakest semantic relationship between two rows of pixel data at the fragment edges, but it cannot necessarily determine that these two fragments have a genuine connection (Tang et al., 2016). Furthermore, existing image fragment carving methods rarely target physical memory media. Extracting and carving image data from physical memory are extremely important for reconstructing digital crime scenes. Research shows that the file fragments within memory images are highly fragmented, making it impossible to reconstruct fragmented files using image file carving methods designed for disk media (van Baar et al., 2008). Wu et al. (2019) proposed an image fragment carving algorithm using memory structure chains; this method primarily uses file metadata left by the operating system on memory media for file reconstruction and does not study the connection between image fragments in memory.

Currently, many researchers use discrete cosine transform (DCT) to address challenges in the image domain, such as image fusion, texture recognition, and object recognition (Bharati et al., 2004). However, its application remains limited in the specific area of image fragment carving, particularly within the context of fragment connection weighting algorithms. The Joint Photographic Experts Group (JPEG) image encoding process uses DCT to convert image data—for instance, the intensity values of 64 pixels within an 8×8 block—into corresponding DCT coefficients, which are subsequently stored on the storage medium. While the DCT value...