File carving for fragmented JPEG files

Digital photos can be part of many criminal acts such as child pornography and cyber-bullying. Therefore, it is vital during a forensic investigation to be able to restore possibly deleted photos from storage media like hard disks or flash drives. If such a recovery is performed without using information from file system metadata, this process is called file carving. In this paper, we present a file carving approach to recover deleted photos even if they are fragmented on the storage medium. We implemented a prototype which is able to restore more photos correctly from a set of standard file carving test sets than popular open source carvers such as Foremost, Scalpel, and PhotoRec