Abstract
The increasing prevalence of cybercrimes has led to a surge of new forensics tools aimed at collecting digital evidence from a suspect’s computer. A suspect’s hard drive can be the largest source of collected information, but the task of collection can be made significantly more difficult when the contents of a hard drive are deleted or damaged. In these circumstances the information needed to read files normally may be missing, leaving only the raw, often fragmented, data behind. If we were able to reliably reconstruct files from this raw data, then it would be more difficult for suspects to destroy potential evidence. Currently, several techniques exist for reconstructing files from this fragmented data, but the accuracy of these methods is often limited by the metrics used to determine the similarity between file segments. Furthermore, even though there is a commercial market for tools that claim to recover deleted photos, the methods, implementations, and accuracies of these tools are largely kept private for financial reasons. In this thesis, we focus on the reconstruction of a single image from a set of fragments. This research contributes a novel image reconstruction method which utilizes pre-stitch data extraction on individual data sectors. We show that, when certain attributes are successfully extracted from the data sectors, this method yields a high reconstruction accuracy even when used with a naïve stitching algorithm on heavily fragmented image files.