A security carving approach for AVI video based on frame size and index

Recovery of fragmented files is an important part of digital forensics. Video files are more likely to be fragmented since their sizes are relatively large that recovering video files without the file system information is meaningful. This paper presents a video recovery technique of a fragmented video file using the frame size information in every frame and the index. Many existing video recovery techniques attempt to recover videos using file system information or header/footer flag. These approaches may fail in the situations which the file system information is unknown or videos are fragmented. The proposed method addresses how to extract AVI file fragments from data images and map all the extracted fragments into original order. Experiments result show that mapping the AVI fragments according to the frame size information in every fragment and index is credible and the non-overwritten part of the fragmented video can be recovered using the method.