University of Cambridge > > Computer Laboratory Security Group meeting presentations > Defragmentation of compressed bitstreams for H.264/AVC video evidence recovery

Defragmentation of compressed bitstreams for H.264/AVC video evidence recovery

Add to your list(s) Download to your calendar using vCal

If you have a question about this talk, please contact Markus Kuhn.

The latest generation of video cameras use the H.264/AVC compression format to store video data efficiently. Because the files are usually larger than a single block of storage, they may be split up into many fragments when they are written to disk or memory. Fragmentation can occur when no sufficiently long runs of contiguous blocks are available, and also in flash memory devices which try to avoid wearing out individual blocks by distributing writes.

Fragmentation is a problem for forensic investigators whenever block allocation information is inconvenient to access or completely absent. Files might be deleted but intact in unallocated space, or fragmented in flash memories with inaccessible wear-levelling metadata. Compressed bitstreams are particularly difficult to defragment based on content alone because they are produced by algorithms which try to remove redundancy.

In this talk, I present a general-purpose algorithm for location and defragmentation of compressed bitstreams with arbitrarily permuted blocks, without relying on detailed information about multimedia containers or filesystem layout. The algorithm uses an efficient syntax-checking parser as part of a specialized search algorithm, taking advantage of remaining redundancy in compressed bitstreams due to restrictions on syntax.

I demonstrate the algorithm on Baseline profile H.264/AVC bitstreams, and show that it can locate and defragment video files from a variety of video sources, memories and block sizes.

This talk is part of the Computer Laboratory Security Group meeting presentations series.

Tell a friend about this talk:

This talk is included in these lists:

Note that ex-directory lists are not shown.


© 2006-2022, University of Cambridge. Contact Us | Help and Documentation | Privacy and Publicity