A Study Of AVI Video Carving

With the development of information technology, data recovery, especially the recovery of fragmented files is getting more and more attention. Traditional data recovery technique depends on the file system meta-information and has many drawbacks. File carving is a depth data recovery technique which does not rely on file system information has overcome the shortcomings of the traditional technique and become the new research focus of the field of computer forensics. Video files are important sources of digital evidence and video files are more likely to be fragmented since their sizes are relatively large. Therefore researching the technique of recovering video files without the file system information is meaningful.This article focuses on the recovery of video files without referencing file system information.The article starts from in-depth review of existing file carving techniques,analuzes the inner structure and feature of AVI files and proposed a file carving method for AVI files. The main contribution of the article is listed as follows. First of all,the article carries thorough analysis on the existing file carving technique and state the advantage and disadvantage of each technique. Secondly, the article researches the AVI data extraction and AVI fragments restoration technique. An AVI data extraction method based on AVI inner feature and an AVI fragments resoration method based on frame size information is proposed.Thirdly,a AVI carving forensic tool is developed based on the proposed method. Finally,several tests are made to test the proposed method and tool. The experiment results show that the AVI video recovery technique based on the frame size information in every frame and the index is feasible and effective. The non-overwritten part of the fragmented video can be recovered using the method.In summary, the article analyzes the existing file carving technique and proposed an AVI carving method and tool.In addition, the research findings have been approved to be effective and practical by experiments.