Forensic Analysis of the Uncompressed Image Data Cluster for Estimating the Image Width

A forensic expert examining the disk encounters unallocated disk blocks. The unallocated blocks may contain data of deleted files. The forensic expert needs to perceive the disk block content. For example, given raw data present in a disk block, he needs to display the image fragment, if the block belongs to an image file. In this paper, we present a method to correctly determine the image width by using one of the uncompressed image data blocks. The areas of digital forensics and file recovery use the file carving algorithms. The file carving algorithms, for carving image files, require the header of the image. From the header, the file carving algorithm finds width of the image. But it is possible that the block containing the image header is not available. In such a case, a file carving algorithm can use the techniques proposed in this paper to find the image width and then proceed to carve a file even when the image header is not available. We present the experimental results of our findings.