Abstract
Video files of surveillance cameras frequently play a role of major evidence for criminals or accidents. But, if the video file containing the evidence is deleted, we need to recover it if possible. In this paper, we propose a recovery scheme for deleted video files with AVI format on FAT32 file system. The proposed scheme first recovers deleted video files from unallocated storage space exploiting both signatures of video frames and behaviours of file systems. The scheme finds fragments of deleted video files based on the start indicator of video frames or the file header signature, and connects the found fragments based on the file allocation patterns of FAT32 file system. Next, if a recovered video file is partially corrupted, the scheme automatically reconstructs the corrupted AVI video file so that the video file can be played back. The lost file header of the corrupted video file is reconstructed based on the file header of a reference video file, and the lost data multimedia data is filled with zero. Through practical implementation, we show that the proposed scheme recovers deleted video files from unallocated storage space and reconstructs corrupted AVI video files.
Similar content being viewed by others
Notes
This tool can be found at https://drive.google.com/drive/folders/12rsbNOUeJOor7AEBfhmTWCg_PEFnGzyO?usp=sharing
References
Alghafli K, Martin T (2016) Identification and recovery of video fragments for forensics file carving. In: IEEE International Conference for Internet Technology and Secured Transactions(ICITST), vol 11, pp 267–272
Carrier B (2005) File system forensic analysis. Addison-Wesley, Boston
Casey E, Zoun R (2014) Design tradeoffs for developing fragmented video carving tools. Digit Investig 11(2):S30–S39
Garfinkel SL (2007) Carving contiguous and fragmented files with fast object validation. Digit Investig 4:2–12
Grau GmbH Hardware & Software Solutions Video repair tool. http://grauonline.de/cms2/?page_id=5
KernelApps Private Limited Kernel video repair. https://www.nucleustechnologies.com/video-repair
Lee WY, Kwon H, Lee H (2015) Comments on the Linux FAT32 allocator and file creation order reconstruction. Digit Investig 15:119–123
Lee WY, Kim KH, Lee H (2019) Extraction of creation-time for recovered files on windows FAT32 file system. Appl Sci 9(24):5522
Microsoft (2000) Microsoft extensible firmware initiative FAT32 file system specification. http://msdn.microsoft.com/en-us/library/windows/hardware/gg463080.aspx
Microsoft (2018) AVI file format. http://msdn.microsoft.com/en-us/library/windows/desktop/dd318187(v=vs.85).aspx
Minnaard W (2014) The Linux FAT32 allocator and file creation order reconstruction. Digit Investig 11(4):224–233
Na G-H, Shin K-S, Moon K-W, Kong SG, Kim E-S, Lee J (2013) Frame-based recovery of corrupted video files using video codec specifications. IEEE Trans Image Process 23(2):317–326
Poisel R, Tjoa S (2013) A comprehensive literature review of file carving. In: IEEE international conference on Availability, Reliability and Security(ARES), vol 8, pp 475–484
Poisel R, Rybnicek M, Schildendorfer B, Tjoa S (2013) Classification and recovery of fragmented multimedia files using the file carving approach. Int J Mob Comput Multimed Commun 5(3):50–67
Remo Software Remo recover. http://www.remorecover.com
Richard GG, Roussev V (2005) Scalpel: A frugal, high performance file carver. In: Proceeding of the Digital Forensic Research Workshop(DFRWS), vol 5, pp 1–10
Sim SG, Kim ES, Kim DS, Lee SW, Lee WY (2019) Apparatus and method for verifying the integrity of video file. Patent of United States, Registration No. US10,382,835
Song J, Lee K, Lee W Y, Lee H (2016) Integrity verification of the ordered data structures in manipulated video content. Digit Investig 18(C):1–7
Stellar Data Recovery Inc. Repair for video. http://www.stellarinfo.com/disk-recovery/video-repair.php
Yang Y, Xu Z, Liu L, Sun G (2017) A security carving approach for AVI video based on frame size and index. Multimed Tools Appl 76(3):3293–3312
Yoo B, Park J, Lim S, Bang J, Lee S (2012) A study on multimedia file carving method. Multimed Tools Appl 61(1):243–261
Acknowledgements
This research was supported by Basic Science Research Program through the National Research Foundation Korea (NRF) funded by the Ministry of Education (NRF-2018R1D1A1B07045806).
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher’s note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
About this article
Cite this article
Lee, W.Y., Kim, K.H., Yang, H. et al. Automatic reconstruction of deleted AVI video files composed of scattered and corrupted fragments. Multimed Tools Appl 79, 28355–28367 (2020). https://doi.org/10.1007/s11042-020-09404-5
Received:
Revised:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s11042-020-09404-5