Downloaded 2021-09-27T13:07:33Z
Total Page：16
File Type：pdf, Size：1020Kb
Provided by the author(s) and University College Dublin Library in accordance with publisher policies. Please cite the published version when available. Title Investigation and Automating Extraction of Thumbnails Produced by Image viewers Authors(s) Meer, Wybren van der; Choo, Kim-Kwang Raymond; Le-Khac, Nhien-An; Kechadi, Tahar Publication date 2017-08-04 Publication information Proceedings of the TrustCom 2017, BigDataSE 2017, & ICESS 2017 Conferences Conference details TrustCom 2017, BigDataSE 2017, & ICESS 2017, Sydney, Australia, 1-4 August 2017 Publisher IEEE Item record/more information http://hdl.handle.net/10197/9057 Publisher's statement © 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works Publisher's version (DOI) 10.1109/Trustcom/BigDataSE/ICESS.2017.355 Downloaded 2021-09-27T13:07:33Z The UCD community has made this article openly available. Please share how this access benefits you. Your story matters! (@ucd_oa) © Some rights reserved. For more information, please see the item record link above. Investigation and Automating Extraction of Thumbnails Produced by Image viewers Wybren van der Meer Kim-Kwang Raymond Choo Nhien-An Le-Khac, M-Tahar School of Computer Science Department of Information Systems, Kechadi University College Dublin, University of Texas at San Antonio, School of Computer Science Belfield, Dublin 4, Ireland San Antonio, TX 78258, USA University College Dublin, wybren.van-der- [email protected] Belfield, Dublin 4, Ireland [email protected] {an.lekhac,tahar.kechadi}@ucd.ie Abstract— Data carving is generally used to recover deleted challenges. The first challenge is the storage locations for the images in digital investigations, but carving time can be databases containing the thumbnails differ between image significant and the deleted images may have been overwritten. viewer [5], and there are many image viewers in the market Thus, thumbnails of (deleted) images are an alternative evidence, [6]. When a database containing thumbnails is located, another and can often be found within databases created by either challenge is to extract available relevant information. These operating systems or image viewers. Existing literature generally databases often have their own way of storing thumbnails. focus on the extraction of thumbnails from databases created by Consequently, traditional ways of extracting information could the operating system. Understanding thumbnails created by not be applied. One traditional way of extracting information is image reviewers is relatively understudied. Therefore, in this to use data carving. Carving tools take into account sector size paper, we propose a new approach of automating extraction of of a hard disk [7]. When a carving tool finds an image, the tool thumbnails produced by image viewers. We then evaluate the utility of our approach using popular image viewers. often skips a certain amount of disk space. The skipping of a certain amount of disk space is performed because partitions on Keywords—thumbnails; image acquisition; thumbnail storage devices have a dedicated minimal storage space for forensics; automate process; each file. Hence, the skipping of this minimal storage space of each file is done to make the carving process faster. Thumbnails within a database can however, ignore these I. INTRODUCTION minimal storage spaces, as the database itself is one file. A Images are a common source of evidence in a typical digital carving program does not know when there are multiple investigation, such as those involving child abusive materials thumbnails within one file and automatically skips the minimal (CAM) [1]. Images once downloaded to a device are usually storage space, a space where other thumbnails may reside. viewed using image viewers. Standard image viewers in operating system do not provide a way to effectively organize A scan of the literature suggests that investigating image and categorize image collections. To effectively organize databases is a relatively unexplored practice. Most information image collections, the users will need to use specialized image found was related to current carving methods, databases and viewers such as Xnview [2] and ACDsee [3]. thumbnails in general. Besides, the large number of thumbnails stored in databases is also a challenge in terms of the amount of To effectively organize and categorize the images, image time required in the investigation. This is referred to as the big viewers normally save information about the images (also forensic data challenge by Quick and Choo [8][9][10][11]. known as image meta-data). The image meta-data may contain thumbnails, dates, EXIF information and other information of Therefore, in this paper, we propose a new approach to forensic interest [4]. The image meta-data is saved in locate and extract thumbnails from image viewers. First, this databases, which reside on the hard disk of the machine with approach is to locate the image databases by examining the the installed image viewer. These databases may also contain image viewers and then to search for changes made on the hard meta-data information of images no longer available (e.g. drive. The changes provided clues to the location of the image images can be deleted, or reside on other sources that are not databases. When the image database is found, we then extract available to access at that time. Eventually, when the source the thumbnails using different techniques described in this image is not available, the databases of image meta-data from paper, based on the three different storage structures observed. image viewers are the only important sources of information Another contribution of this paper is to automate the entire available to investigators. proposed process of investigation, using freely available tools and code to reduce the time needed for the forensic The image meta-data we look at in this paper is the investigation. thumbnails. In the literature, most research and practical focus on the extraction of thumbnails from databases created by the The rest of this paper is organized as follow: Section II operating system. There is little research focusing on reviews related literature. We present the problem statement of thumbnails created by image reviewers due to many investigating the thumbnails from image viewers in Section III. We describe our approach in Section IV. Findings are presented in Section V. Finally, we conclude and discuss future the pattern in the beginning of one other fragment, statistical work in Section VI. tests were conducted in order to validate if the fragments should be stitched together. II. RELEATED WORK Recovering data from databases may not be possible with With the increasing size of images due to advances in carving, as the structure may be different. It is possible to image sensors and capturing capabilities, thumbnails are often retrieve data from databases by other means. In the study of used to expedite the viewing of images and minimize data [24], some work has been done on recovering data from DBMS usage [12]. Thumbnails are often created before a picture has structures. Another subject to consider is compressed data been manipulated. The original picture can then be altered, and within databases. There are methods for extracting the the thumbnail associated to an image would then be different compressed streams, however, errors may occur [25]. compared to the new altered image [13]. Thumbnails also offer a useful source of information about an image if the original is III. PROBLEM STATEMENT no longer available. One good way of investigating an image is When the original images are no longer available, and to reverse search the image. In this manner, the source of the original image can be tracked down [14]. The reverse searching cannot be retrieved by carving files, one has to look for different sources of information. One source may be forensic can also be performed with just the thumbnail. artefacts created when an image is viewed. An image can be For example, Quick, Tassone and Choo conducted a browsed and viewed by the file explorer of an operating forensic analysis of Windows thumbcache files [15]. The system. This may lead to the creation of a thumbnail. Also research provides a blueprint on how to design an automated metadata of the file may be stored. The retrieving of tool for investigated thumbnails. It does, however, focus only thumbnails and metadata from artefacts within the file explorer on thumbnails created by the different Windows operating of an operating system has been researched and will remain an systems. Thumbnails made by individual programs were not ongoing research area, due to constant updates in operating investigated. systems. Information is however not stored within the database of the operating system if the image was viewed by other In [16], the authors focus on when Windows thumbnails are means. When an image is viewed by a specialized image created. The authors conclude that sometimes thumbnails are viewer, forensics artefacts may be created by the viewer itself. even produced when the user does not browse related pictures. The method used for storing the information by a viewer may The actually viewing of a picture is a parameter and has been differ between different brands, and can change with each new taken into account during the choice of the method to version. The viewer, like the operating system, can store investigate thumbnails generated by image viewers. information within a database. The storing of the information Thumbnails produced by Android were also previously in a database has different purposes. One main consideration investigated [17]. In this research, the authors focus on for storing thumbnails is the speed increase for showing many extracting thumbnails and the file information of the original pictures within a gallery mode.