Defragmentation of compressed bitstreams for H.264/AVC video evidence recovery

Add to your list(s) Download to your calendar using vCal

• Andrew Lewis (University of Cambridge)
• Friday 18 March 2011, 16:00-16:30
• Computer Laboratory, William Gates Building, Room FW11.

If you have a question about this talk, please contact Markus Kuhn.

The latest generation of video cameras use the H.264/AVC compression format to store video data efficiently. Because the files are usually larger than a single block of storage, they may be split up into many fragments when they are written to disk or memory. Fragmentation can occur when no sufficiently long runs of contiguous blocks are available, and also in flash memory devices which try to avoid wearing out individual blocks by distributing writes.

Fragmentation is a problem for forensic investigators whenever block allocation information is inconvenient to access or completely absent. Files might be deleted but intact in unallocated space, or fragmented in flash memories with inaccessible wear-levelling metadata. Compressed bitstreams are particularly difficult to defragment based on content alone because they are produced by algorithms which try to remove redundancy.

In this talk, I present a general-purpose algorithm for location and defragmentation of compressed bitstreams with arbitrarily permuted blocks, without relying on detailed information about multimedia containers or filesystem layout. The algorithm uses an efficient syntax-checking parser as part of a specialized search algorithm, taking advantage of remaining redundancy in compressed bitstreams due to restrictions on syntax.

I demonstrate the algorithm on Baseline profile H.264/AVC bitstreams, and show that it can locate and defragment video files from a variety of video sources, memories and block sizes.

This talk is part of the Computer Laboratory Security Group meeting presentations series.

This talk is included in these lists:

• All Talks (aka the CURE list)
• Cambridge talks
• Computer Laboratory Security Group meeting presentations
• Computer Laboratory, William Gates Building, Room FW11
• Department of Computer Science and Technology talks and seminars
• Interested Talks
• School of Technology
• Security-related talks
• Trust & Technology Initiative - interesting events
• bld31

Note that ex-directory lists are not shown.