Forensics investigations of multimedia data: A review of the state-of-the-art

Proceedings - 6th International Conference on IT Security Incident Management and IT Forensics, IMF 2011

Volumn , Issue , 2011, Pages 48-61

  Poisel, Rainer ^a   Tjoa, Simon ^a  

^a St Poelten University of Applied Sciences   (Austria)

Author keywords

Content classification; Content forgery; Data recovery approaches for multimedia files; Digital Forensics; Environment classification; Fragment Identification; Multimedia Data; Source identification; State of the Art; Steganography and Steganalysis; Survey

Indexed keywords

CONTENT CLASSIFICATION; CONTENT FORGERY; DATA RECOVERY; DIGITAL FORENSIC; ENVIRONMENT CLASSIFICATION; FRAGMENT IDENTIFICATION; MULTIMEDIA DATA; SOURCE IDENTIFICATION; STATE-OF-THE-ART;

COMPUTER CRIME; CRIME; ELECTRONIC CRIME COUNTERMEASURES; INFORMATION TECHNOLOGY; INVESTMENTS; RESEARCH; SECURITY SYSTEMS; STEGANOGRAPHY;

COMPUTER FORENSICS;

EID: 79960728203     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IMF.2011.14     Document Type: Conference Paper

References (91)

1. K. Medaris and R. Mislan. (2008, April) Expert: Digital evidence just as important as dna in solving crimes. [Online]. Available: http://news.uns.purdue. edu/x/2008a/080425T-MislanPhones.html
2. N. D. M. Sencar, H. T., "Overview of state-of-the-art in digital image forensics," in WSPC - Proceedings, September 2007.
3. T. V. Lanh, K.-S. Chong, S. Emmanuel, and M. S. Kankanhalli, "A survey on digital camera image forensic methods," in ICME, 2007, pp. 16-19.
4. R. Böhme, F. C. Freiling, T. Gloe, and M. Kirchner, "Multimedia forensics is not computer forensics," in IWCF, 2009, pp. 90-103.
5. J. Fürch and J. Meyer, "Digitale multimediaforensik," TU-Darmstadt, Tech. Rep., 2010.
6. C.-T. Li, "Source camera linking using enhanced sensor pattern noise extracted from images," in Proc. the 3rd International Conference on Imaging for Crime Detection and Prevention (ICDP-09), 2009.
7. -, "Source camera identification using enhanced sensor pattern noise," IEEE Transactions on Information Forensics and Security, vol. 5, no. 2, pp. 280-287, 2010.
8. Y. Li, C.-T. Li, "Digital camera identification using colour-decoupled photo response non-uniformity noise pattern," in Proceedings of 2010 IEEE International Symposium on Circuits and Systems (ISCAS), 2010.
9. H. Gou, A. Swaminathan, and M. Wu, "Intrinsic sensor noise features for forensic analysis on scanners and scanned images," Trans. Info. For. Sec., vol. 4, pp. 476-491, September 2009. [Online]. Available: http://portal.acm.org/citation.cfm?id=1651180.1651198
10. W. van Houten and Z. Geradts, "Source video camera identification for multiply compressed videos originating from youtube," Digital Investigation, vol. 6, no. 1-2, pp. 48-60, 2009.
11. L.-J. Li and L. Fei-Fei, "What, where and who? classifying events by scene and object recognition," Computer Vision, IEEE International Conference on, vol. 0, pp. 1-8, 2007.
12. J. Luo, W. Hao, D. McIntyre, D. Joshi, and J. Yu, "Recognizing picture-taking environment from satellite images: A feasibility study," in ICPR, 2008, pp. 1-4.
13. J. Wu and J. M. Rehg, "Where am i: Place instance and category recognition using spatial pact," Computer Vision and Pattern Recognition, IEEE Computer Society Conference on, vol. 0, pp. 1-8, 2008.
14. -, "Centrist: A visual descriptor for scene categorization," IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 99, no. PrePrints, pp. 1-14, 2010.
15. S. Divvala, D. Hoiem, J. Hays, A. Efros, and M. Hebert, "An empirical study of context in object detection," Computer Vision and Pattern Recognition, IEEE Computer Society Conference on, vol. 0, pp. 1271-1278, 2009.
16. C. Kraetzer, A. Oermann, J. Dittmann, and A. Lang, "Digital audio forensics: a first practical evaluation on microphone and environment classification," in Proceedings of the 9th workshop on Multimedia & security, ser. MM-Sec '07. New York, NY, USA: ACM, 2007, pp. 63-74. [Online]. Available: http://doi.acm.org/10.1145/1288869.1288879
17. E. B. Brixen, "Enf; quantification of the magnetic field," in Audio Engineering Society Conference: 33rd International Conference: Audio Forensics-Theory and Practice, 6 2008. [Online]. Available: http://www.aes.org/ e-lib/browse.cfm?elib=14412
18. D. P. N. Rodríguez, J. A. Apolinário, and L. W. P. Biscainho, "Audio authenticity: detecting enf discontinuity with high precision phase analysis," Trans. Info. For. Sec., vol. 5, pp. 534-543, September 2010. [Online]. Available: http://dx.doi.org/10.1109/TIFS.2010.2051270
19. C. Grigoras, "Digital audio recording analysis the electric network frequency criterion," Diamond Cut Productions, Inc., Tech. Rep. Application Notes, AN-4, 2003.
20. Name Unknown, "Polizei zerschlägt Kinderporno-Ring mit 2360 Verdächtigen," http://www.spiegel.de/panorama/justiz/0,1518,464920,00. html, February 2007, [Online; Status 25/08/2010].
21. C. Jansohn, A. Ulges, and T. M. Breuel, "Detecting pornographic video content by combining image features with motion information," in ACM Multimedia, 2009, pp. 601-604.
22. A. van den Hengel, R. Hill, H. Detmold, and A. Dick, "Searching in space and time: a system for forensic analysis of large video repositories," in Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop, ser. e-Forensics '08. ICST, Brussels, Belgium, Belgium: ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering), 2008, pp. 4:1-4:6. [Online]. Available: http://portal.acm.org/citation.cfm?id=1363217.1363223
23. L. Huston, R. Sukthankar, J. Campbell, and P. Pillai, "Forensic video reconstruction," in Proceedings of the ACM 2nd international workshop on Video surveillance & sensor networks, ser. VSSN '04. New York, NY, USA: ACM, 2004, pp. 20-28. [Online]. Available: http://doi.acm.org/10.1145/1026799. 1026805
24. M. de Castro Polastro and P. M. da Silva Eleuterio, "Nudetective: A forensic tool to help combat child pornography through automatic nudity detection," in DEXA Workshops, 2010, pp. 349-353.
25. R. Ap-apid, "An algorithm for nudity detection," in Proceedings of the 5th Philippine Computer Science Congress, 2005.
26. T. Deselaers, L. Pimenidis, and H. Ney, "Bag-of-visual-words models for adult image classification and filtering," in ICPR, 2008, pp. 1-4.
27. F. Ramsthaler, M. Kettner, S. Potente, A. Gehl, K. Kreutz, and M. Verhoff, "Original oder manipuliert?" Rechtsmedizin, vol. 20, pp. 385-392, 2010, 10.1007/s00194-010-0669-1.
28. A. C. Popescu and H. Farid, "Exposing digital forgeries by detecting duplicated image regions," Dartmouth College, Computer Science, Tech. Rep. TR2004-515, 2004.
29. B. L. Shivakumar, "Detecting copy-move forgery in digital images: A survey and analysis of current methods," Global Journal of Computer Science and Technology, vol. 10, pp. 61-65, 2010.
30. S. Bayram, H. T. Sencar, and N. Memon, "A survey of copy-move forgery detection techniques," in IEEE Western New York Image Processing Workshop, 2008.
31. S. Bayram, H. Taha Sencar, and N. Memon, "An efficient and robust method for detecting copy-move forgery," in Proceedings of the 2009 IEEE International Conference on Acoustics, Speech and Signal Processing, ser. ICASSP '09. Washington, DC, USA: IEEE Computer Society, 2009, pp. 1053-1056. [Online]. Available: http://dx.doi.org/10.1109/ICASSP.2009.4959768
32. B. Mahdian and S. Saic, "A bibliography on blind methods for identifying image forgery," Signal Processing: Image Communication, vol. 25, no. 6, pp. 389-399, 2010. [Online]. Available: http://www.sciencedirect.com/ science/article/B6V08-505N6XX-1/2/da59292ef818716646092b465521f7bc
33. W. Wang, J. Dong, and T. Tan, "A survey of passive image tampering detection," in Digital Watermarking, ser. Lecture Notes in Computer Science, A. Ho, Y. Shi, H. Kim, and M. Barni, Eds. Springer Berlin / Heidelberg, 2009, vol. 5703, pp. 308-322.
34. H. Farid, "Nist colloquium series: Digital forensics," October 2008, [Online; Status 16/01/2010].
35. R. Maher, "Overview of audio forensics," in Intelligent Multimedia Analysis for Security Applications, ser. Studies in Computational Intelligence, H. Sencar, S. Velastin, N. Nikolaidis, and S. Lian, Eds. Springer Berlin / Heidelberg, 2010, vol. 282, pp. 127-144.
36. -, "Audio forensic examination: authenticity, enhancement, and interpretation," in IEEE Signal Processing Magazine, vol. 26, no. 2, 2009, pp. 84-94.
37. C. Grigoras, "Applications of enf analysis in forensic authentication of digital audio and video recordings," Journal of Audio Engineering Society, vol. 57, no. 9, pp. 643-661, 2009.
38. W. Bender, D. Gruhl, N. Morimoto, and A. Lu, "Techniques for data hiding," IBM Syst. J., vol. 35, pp. 313-336, September 1996.
39. W. Wang, "Digital video forensics," Ph.D. dissertation, Dartmouth College, Hanover, NH, USA, 2009, adviser-Farid, Hany.
40. W. Wang and H. Farid, "Exposing digital forgeries in video by detecting duplication," in Proceedings of the 9th workshop on Multimedia & security, ser. MM-Sec '07. New York, NY, USA: ACM, 2007, pp. 35-42. [Online]. Available: http://doi.acm.org/10.1145/1288869.1288876
41. -, "Exposing digital forgeries in video by detecting double quantization," in Proceedings of the 11th ACM workshop on Multimedia and security, ser. MM-Sec '09. New York, NY, USA: ACM, 2009, pp. 39-48. [Online]. Available: http://doi.acm.org/10.1145/1597817.1597826
42. M. Kobayashi, T. Okabe, and Y. Sato, "Detecting video forgeries based on noise characteristics," in Advances in Image and Video Technology, ser. Lecture Notes in Computer Science, T. Wada, F. Huang, and S. Lin, Eds. Springer Berlin / Heidelberg, 2009, vol. 5414, pp. 306-317.
43. B. Carrier, File System Forensic Analysis. Addison-Wesley Professional, 2005.
44. K. Shanmugasundaram and N. Memon, "Automatic reassembly of document fragments via data compression," in Digital Forensics Research Workshop, August 2002.
45. N. D. M. Anandabrata Pal, "The evolution of file carving," IEEE Signal Processing Magazine, vol. March 2009, pp. 59-71, 03 2009.
46. D. Billard and R. Hauri, "Making sense of unstructured flash-memory dumps," in SAC, 2010, pp. 1579-1583.
47. O. Avni and T. Knierim, "Carving und semantische analyse in der digitalen forensik," Fraunhofer IGD, Tech. Rep., 2010.
48. G. G. R. III and V. Roussev, "Scalpel: A frugal, high performance file carver," in DFRWS, 2005.
49. G. G. R. III, V. Roussev, and L. Marziale, "In-place file carving," in IFIP Int. Conf. Digital Forensics, 2007, pp. 217-230.
50. "Fuse: Filesystem in userspace," http://fuse.sourceforge.net, [Online; Status 22/10/2010].
51. S. L. Garfinkel, "Carving contiguous and fragmented files with fast object validation," Digital Investigation, vol. 4, no. Supplement 1, pp. 2-12, 2007. [Online]. Available: http://www.sciencedirect.com/science/article/ B7CW4-4P06CJD-1/2/48c9cdedb7d3e76b5880b58c871110be
52. A. Pal, H. T. Sencar, and N. Memon, "Detecting file fragmentation point using sequential hypothesis testing," Digital Investigation, vol. 5, no. Supplement 1, pp. S2-S13, 2008, the Proceedings of the Eighth Annual DFRWS Conference. [Online]. Available: http://www.sciencedirect.com/science/article/ B7CW4-4T5SYCF-3/2/3ce3ceeea25479675b0156d1cfc5ae6b
53. A. Pal and N. D. Memon, "Automated reassembly of file fragmented images using greedy algorithms," IEEE Transactions on Image Processing, vol. 15, no. 2, pp. 385-393, 2006.
54. K. Shanmugasundaram and N. Memon, "Automatic reassembly of document fragments via context based statistical models," in Context Based Statistical Models ACSAC, 2003, 2003, pp. 152-159.
55. T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction to Algorithms. MIT Press, 2001.
56. M. Karresand and N. Shahmehri, "Reassembly of fragmented jpeg images containing restart markers," Computer Network Defense, European Conference on, vol. 0, pp. 25-32, 2008.
57. K. Mohamad and M. Deris, "Fragmentation point detection of jpeg images at dht using validator," in Future Generation Information Technology, ser. Lecture Notes in Computer Science, Y.-h. Lee, T.-h. Kim, W.-c. Fang, and D. Slezak, Eds. Springer Berlin / Heidelberg, 2009, vol. 5899, pp. 173-180.
58. H. T. Sencar and N. Memon, "Identification and recovery of jpeg files with missing fragments," Digital Investigation, vol. 6, no. Supplement 1, pp. S88-S98, 2009, the Proceedings of the Ninth Annual DFRWS Conference. [Online]. Available: http://www.sciencedirect.com/science/article/ B7CW4-4X1HY5C-D/2/7b6b8f0c39bb4f301335cb3a5e6ca946
59. Automated reassembly of fragmented images, vol. 1, 2003. [Online]. Available: http://isis.poly.edu/kulesh/research/pubs/icassp- 2003.pdf
60. "Adroit photo forensics 2010," http://digital-assembly.com, [Online; Status 22/10/2010].
61. M. McDaniel and M. H. Heydari, "Content based file type detection algorithms," in HICSS '03: Proceedings of the 36th Annual Hawaii International Conference on System Sciences (HICSS'03) - Track 9. Washington, DC, USA: IEEE Computer Society, 2003, p. 332.1.
62. C. J. Veenman, "Statistical disk cluster classification for file carving," Information Assurance and Security, International Symposium on, vol. 0, pp. 393-398, 2007.
63. S. Garfinkel, A. Nelson, D. White, and V. Roussev, "Using purpose-built functions and block hashes to enable small block and sub-file forensics," Digital Investigation, vol. 7, no. Supplement 1, pp. S13-S23, 2010, the Proceedings of the Tenth Annual DFRWS Conference. [Online]. Available: http://www.sciencedirect.com/science/article/B7CW4-50NX65H-4/2/ 992954f303e13b95b4d06dde70d19cc9
64. V. Roussev and S. L. Garfinkel, "File fragment classification-the case for specialized approaches," in SADFE, 2009, pp. 3-14.
65. A. Nissar and A. Mir, "Classification of steganalysis techniques: A study," Digital Signal Processing, vol. 20, no. 6, pp. 1758-1770, 2010.
66. A. Cheddad, J. Condell, K. Curran, and P. M. Kevitt, "Digital image steganography: Survey and analysis of current methods," Signal Processing, vol. 90, no. 3, pp. 727-752, 2010.
67. H. Wang and S. Wang, "Cyber warfare: steganography vs. steganalysis," Commun. ACM, vol. 47, pp. 76-82, October 2004.
68. S. Lyu and H. Farid, "Steganalysis using higher-order image statistics," IEEE Transactions on Information Forensics and Security, vol. 1, no. 1, pp. 111-119, 2006.
69. N. Meghanathan and L. Nayak, "A review of the audio and video steganalysis algorithms," in Proceedings of the 48th Annual Southeast Regional Conference, ser. ACM SE 10. New York, NY, USA: ACM, 2010, pp. 81:1-81:5.
70. R. Chandramouli and K. P. Subbalakshmi, "Current trends in steganalysis: a critical survey," in ICARCV, 2004, pp. 964-967.
71. B. Li, J. He, J. Huang, and Y. Q. Shi, "A survey on image steganography and steganalysis," Journal of Information Hiding and Multimedia Signal Processing, vol. 2, no. 2, pp. 142-172, 2011.
72. I. K. Maitra, S. Nag, B. Datta, and S. K. Bandyopadhyay, "Digital steganalysis: Review on recent approaches," Journal of Global Research in Computer Science, vol. 2, pp. 1-5, 2011.
73. J. Wiles, T. Alexander, S. Ashlock, S. Ballou, L. Depew, G. Dominguez, A. Ehuan, R. Green, J. Long, K. Reis, A. Schroader, K. Schuler, and E. Thompson, "Murder and money: The story of standards, accreditation, and certification in computer forensics," in Techno Security's Guide to E-Discovery and Digital Forensics. Burlington: Syngress, 2007, pp. 261-276. [Online]. Available: http://www.sciencedirect.com/science/article/B8KKC-4S03888-H/2/ a095905e619b02e15115dad5e8541783
74. ASCLD. (2011, 03) Ascld (american society of crime lab directors/laboratory). [Online]. Available: http://www.ascld.org/
75. A. Shipman and B. S. Institution, Evidential Weight and Legal Admissibility of Information Stored Electronically. Code of Practice for the Implementation of BS 10008. British Standards Institution, 2008. [Online]. Available: http://shop.bsigroup.com/ProductDetail/?pid=000000000030186227
76. A. of Chief Police Officers (ACPO), "Good practice guide for computer-based electronic evidence," http://7safe.com/electronic evidence/index.html.
77. ISO/IEC 17025:2005 - General requirements for the competence of testing and calibration laboratories, International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) Std., 2005.
78. B. Fraser, "Site Security Handbook," RFC 2196 (Informational), Internet Engineering Task Force, Sep. 1997. [Online]. Available: http://www.ietf.org/rfc/rfc2196.txt
79. N. Brownlee and E. Guttman, "Expectations for Computer Security Incident Response," RFC 2350 (Best Current Practice), Internet Engineering Task Force, Jun. 1998. [Online]. Available: http://www.ietf.org/rfc/rfc2350.txt
80. R. Shirey, "Internet Security Glossary," RFC 2828 (Informational), Internet Engineering Task Force, May 2000, obsoleted by RFC 4949. [Online]. Available: http://www.ietf.org/rfc/rfc2828.txt
81. D. Brezinski and T. Killalea, "Guidelines for Evidence Collection and Archiving," RFC 3227 (Best Current Practice), Internet Engineering Task Force, Feb. 2002. [Online]. Available: http://www.ietf.org/rfc/rfc3227.txt
82. M. Meyers and M. Rogers, "Computer forensics: The need for standardization and certification," IJDE, vol. 3, no. 2, p. , 2004.
83. J. Slay, Y.-C. Lin, B. Turnbull, J. Beckett, and P. Lin, "Towards a formalization of digital forensics," in Advances in Digital Forensics V, ser. IFIP Advances in Information and Communication Technology, G. Peterson and S. Shenoi, Eds. Springer Boston, 2009, vol. 306, pp. 37-47.
84. S. L. Garfinkel, "Digital forensics research: The next 10 years," Digital Investigation, vol. 7, no. Supplement 1, pp. S64-S73, 2010, the Proceedings of the Tenth Annual DFRWS Conference. [Online]. Available: http://www.sciencedirect.com/science/article/B7CW4-50NX65H-B/2/ 19b42d7f2ccc4be6794c5a1330a551bb
85. S. Garfinkel, P. Farrell, V. Roussev, and G. Dinolt, "Bringing science to digital forensics with standardized forensic corpora," Digital Investigation, vol. 6, no. Supplement 1, pp. S2-S11, 2009, the Proceedings of the Ninth Annual DFRWS Conference. [Online]. Available: http://www. sciencedirect.com/science/article/B7CW4-4X1HY5C-3/2/ 090ebc16025d598c775d87c8abbb7ae5
86. N. Beebe, "Digital forensic research: The good, the bad and the unaddressed," in Advances in Digital Forensics V, ser. IFIP Advances in Information and Communication Technology, G. Peterson and S. Shenoi, Eds. Springer Boston, 2009, vol. 306, pp. 17-36, 10.1007/978-3-642-04155-6 2;.
87. K. Nance, B. Hay, and M. Bishop, "Digital forensics: Defining a research agenda," Hawaii International Conference on System Sciences, vol. 0, pp. 1-6, 2009.
88. K. Nance, H. Armstrong, and C. J. Armstrong, "Digital forensics: Defining an education agenda," in HICSS, 2010, pp. 1-10.
89. M. Pollitt, K. L. Nance, B. Hay, R. C. Dodge, P. Craiger, P. Burke, C. Marberry, and B. Brubaker, "Virtualization and digital forensics: A research and education agenda," J. Digital Forensic Practice, vol. 2, no. 2, pp. 62-73, 2008.
90. Digital Forensics Association, "Formal education: College education in digital forensics," http://www.digitalforensicsassociation.org/formal- education/, 2010, [Online; Status 02/11/2010].
91. M. Nutzinger and R. Poisel, "Software architecture for real-time steganography in auditive media," in IEEE International Conference on Computational Technologies in Electrical and Electronics Engineering, Irkutsk Listvyanka, Russia, 2010, pp. 100-105.