In this paper, we present a new tool for forensic recovery of single and multi-fragment JPEG/JFIF data files. First, we discuss the basic design and the technical methods composing our proposed data carving algorithm. Next, we compare the performance of our method with the well-known Adroit Photo Forensics (APF) state-of-the art tool. This comparison is centered on both the carving results as well as the obtained data processing speed, and is evaluated in terms of the results that can be obtained for several well-known reference data sets. Important to note is that we specifically focus on the fundamental recovery and fragment matching performance of the tools by forcing them to use various assumed cluster sizes. We show that on all accounts our new tool can significantly outperform APF. This improvement in data processing speed and carving results can be mostly attributed to novel methods to iterate and reduce the data search space and to a novel parameterless method to determine the end of a fragment based on the pixel data. Finally, we discuss several options for future research.

In this paper we present a more efficient approach to the problem of finding the connected components in binary images. In conventional connected components algorithms, the main data structure to compute and store the connected components is the region label image. We replace the region label image with a singly-linked list of line segments (or runs) for each region. This enables us to design a very fast and memory efficient connected components algorithm. Most conventional algorithms require (at least) two raster scans. Those that only need one raster scan, require irregular and unbounded image access. The proposed algorithm is a single pass regular access algorithm and only requires access to the three most recently processed image lines at any given time. Experimental results demonstrate that our algorithm is considerably faster than the fastest conventional algorithm. Additionally, our novel region coding data structure uses much less memory in typical cases than the traditional region label image. Even in worst case situations the processing time of our algorithm is linear with the number of pixels in an image.