College of Computer, Hangzhou Dianzi University, Hangzhou, China

---

Abstract—File fragment classification is an important and difficult problem in digital forensics. Previous works in this area mainly relied on specific byte sequences in file headers and footers, or statistical analysis and machine learning algorithms on data from the middle of the file. This paper introduces a new approach to classify file fragment based on grayscale image. The proposed method treats a file fragment as a grayscale image, and uses image classification method to classify file fragment. Furthermore, two models based on file-unbiased and type-unbiased are proposed to verify the validity of the proposed method. Compared with previous works, the experimental results are promising. An average classification accuracy of 39.7% in file-unbiased model and 54.7% in type-unbiased model are achieved on 29 file types.

Index Terms—file fragment classification, digital forensic, grayscale image

[PDF]

Cite: Tantan Xu, Ming Xu, Yizhi Ren, Jian Xu, Haiping Zhang, Ning Zheng, "A File Fragment Classification Method Based on Grayscale Image," Journal of Computers vol. 9, no. 8, pp. 1863-1870, 2014.