Searching and extracting digital image evidence

Abstract

Searching and extracting digital images are important tasks in disaster recovery and digital forensics. Many modern file systems arrange data in complex ways, and files are often fragmented, which makes these tasks very challenging, especially when the file systems or the underlying storage media are damaged or corrupted. To design efficient and accurate data recovery systems, we require not only the understanding of the underlying file systems, but also the nature of the data in question. In this chapter, we will discuss the difficulties in searching and extracting digital images from possibly corrupted file systems, and introduce some recent advances.