Abstract

The latest generation of video cameras use the H.264/AVC compression format to store video data efficiently. Because the files are usually larger than a single block of storage, they may be split up into many fragments when they are written to disk or memory. Fragmentation can occur when no sufficiently long runs of contiguous blocks are available, and also in flash memory devices which try to avoid wearing out individual blocks by distributing writes.

Fragmentation is a problem for forensic investigators whenever block allocation information is inconvenient to access or completely absent. Files might be deleted but intact in unallocated space, or fragmented in flash memories with inaccessible wear-levelling metadata. Compressed bitstreams are particularly difficult to defragment based on content alone because they are produced by algorithms which try to remove redundancy.

In this talk, I present a general-purpose algorithm for location and defragmentation of compressed bitstreams with arbitrarily permuted blocks, without relying on detailed information about multimedia containers or filesystem layout. The algorithm uses an efficient syntax-checking parser as part of a specialized search algorithm, taking advantage of remaining redundancy in compressed bitstreams due to restrictions on syntax.

I demonstrate the algorithm on Baseline profile H.264/AVC bitstreams, and show that it can locate and defragment video files from a variety of video sources, memories and block sizes.