Recent Advances in JPEG File Carving for Digital Forensics: A Systematic Review and Entropy-based Validation Framework
Abstract
Recovering digital evidence is not as simple as scanning disk sectors anymore. The problem has become significantly more challenging over the last decade due to the evolution of storage architectures and the development of new compression methods. This paper reviews 30 peer- reviewed publications from 2009 to 2025, tracing the evolution of file carving through four stages—Syntax-driven (Generation I), Structure-aware (Generation II), Entropy-based (Generation III), and Hybrid AI-driven (Generation IV). While traditional carving tools only achieve a recovery rate of about 25.2% with fragmented data, which drops to almost zero with severe fragmentation, hybrid approaches using Extreme Learning Machines (ELM) and Generative Algorithms (GA) can achieve up to 97% recovery, although these results have limitations. To test these claims, the study developed the Entropy-Pillow Validation Framework and tested it on 143 forensic samples from NIST and Digital Corpora repositories, achieving an aggregate accuracy of 93.01% with perfect recall. It also proposes a dataset surrogacy metric, scoring 87.5%, to support the use of a public corpus instead of proprietary benchmarks. Finally, it examines two major threats to the field, the silent data erasure by SSD TRIM commands and the forensic challenges posed by the new JPEG AI standard.
References
R. Poisel, S. Tjoa, and P. Tavolato, “Advanced file carving approaches for multimedia files,” Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, vol. 2, no. 4, pp. 42–58, 2011.
National Institute of Standards and Technology (NIST), “Computer forensic reference data sets (CFReDS).”
T. D’Anna et al., “The chain of custody in the era of modern forensics: From the classic procedures for gathering evidence to the new challenges related to digital data,” Healthcare, vol. 11, no. 5, p. 634, 2023.
S. Nath, K. Summers, J. Baek and G. -J. Ahn, “Digital evidence chain of custody: Navigating new realities of digital forensics,” 2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA), Washington, DC, USA, 2024, pp. 11–20.
D. Singh, P. Singh, R. Jena, and R. S. Chakraborty, “An image forensic technique based on JPEG ghosts,” Multimedia Tools and Applications, vol. 82, Sep. 2022.
H. J. Hadi, N. Musthaq and I. U. Khan, “SSD forensic: Evidence generation and forensic research on solid state drives using trim analysis,” 2021 International Conference on Cyber Warfare and Security (ICCWS), Islamabad, Pakistan, 2021, pp. 51–56.
H. Suthar, “A Technique for decreasing the SSD’s garbage collection overhead using ML techniques,” International Conference on Science, Engineering and Technology (ICSET 2022), Nov. 2022.
Nurhayati and N. Fikri, “The analysis of file carving process using PhotoRec and Foremost,” 2017 4th International Conference on Computer Applications and Information Processing Technology (CAIPT), Kuta Bali, Indonesia, 2017, pp. 1–6.
V. van der Meer and J. van den Bos, “JPEG file fragmentation point detection using huffman code and quantization array validation,” ARES '21: Proceedings of the 16th International Conference on Availability, Reliability and Security, Aug. 2021, pp. 1–7.
V. van der Meer, J. van den Bos, H. Jonker, and L. Dassen, “Problem solved: A reliable, deterministic method for JPEG fragmentation point detection,” Forensic Science International: Digital Investigation, vol. 48, Mar. 2024.
E. Uzun and H. T. Sencar, “Carving orphaned JPEG file fragments,” in IEEE Transactions on Information Forensics and Security, vol. 10, no. 8, pp. 1549–1563, Aug. 2015.
J. Guo, J. He, and N. Huang, “Research of multiple-type files carving method based on entropy,” 2015 4th National Conference on Electrical, Electronics and Computer Engineering, Jan 2016, pp. 521–528.
M. E. Zainodin, Z. Zakaria, R. Hassan, and Z. Abdullah, “Entropy based method for malicious file detection,” JOIV International Journal on Informatics Visualization, vol. 6, no. 4, pp. 856–861, Dec. 2022.
W. Liu, Y. Wang, K.-H. Yap, L.-P. Chau, “Bitstream-corrupted JPEG images are restorable: Two-stage compensation and alignment framework for image restoration,” arXiv, 2023.
F. De Gaspari, D. Hitaj, G. Pagnotta, L. De Carli, and L. V. Mancini, “EnCoD: Distinguishing compressed and encrypted file fragments,” in Network and System Security, Cham: Springer International Publishing, 2020, pp. 42–62.
K. Srinivas and T. Adilaxmi, “The file carving method for category B images,” International Journal of Advanced Trends in Computer Science and Engineering, vol. 9, no. 5, 2020.
E. Durmus, P. Korus and N. Memon, “Every shred helps: Assembling evidence from orphaned JPEG fragments,” in IEEE Transactions on Information Forensics and Security, vol. 14, no. 9, pp. 2372–2386, Sept. 2019.
R. R. Ali and K. M. Mohamad, “RX myKarve carving framework for reassembling complex fragmentations of JPEG images,” Journal of King Saud University - Computer and Information Sciences, vol. 33, no. 1, pp. 21–32, Jan. 2021.
M. Felemban, M. Ghaleb, K. Saaim, S. AlSaleh and A. Almulhem, “File fragment type classification using light-weight convolutional neural networks,” in IEEE Access, vol. 12, pp. 157179–157191, 2024.
S. Alam, “SIFT–file fragment classification without metadata,” 2023 3rd International Conference on Computing and Information Technology (ICCIT), Tabuk, Saudi Arabia, 2023, pp. 123–129.
M. Lambertz, R. Uetz, and E. Gerhards-Padilla, “Resurrection: A carver for fragmented files,” in Digital Forensics and Cyber Crime, Cham: Springer International Publishing, Dec. 2014,
pp. 51–66.
E. Levecque, J. Butora, and P. Bas, “Dual JPEG compatibility: A reliable and explainable tool for image forensics,” arXiv, 2025.
H. Suthar and P. Sharma, “An investigation on file carving tool methodologies using scenario based image creation,” Indian Journal of Science and Technology, vol. 17, no. 3, pp. 215–227, Jan 2024.
C. Grajeda, F. Breitinger, and I. Baggili, “Availability of datasets for digital forensics—And what is missing,” Digital Investigation, vol. 22, pp. S94–S105, Aug. 2017.
Garfinkel, Farrell, Roussev and Dinolt, Bringing Science to Digital Forensics with Standardized Forensic Corpora, DFRWS, 2009.
B. Tavassoli, Z. Naghshbandi, and M. Teimouri, “ITC-MNP: A diverse dataset for image file fragment classification,” BMC Research Notes, vol. 17, Dec. 2024.
NIST/CFTT, “Autopsy version 4.21.0: Test results for file carving tool,” U.S. Dept. Homeland Security, 2024.
E. D. Cannas et al., “Is JPEG AI going to change image forensics?,” 2025 IEEE/CVF International Conference on Computer Vision Workshops (ICCVW), Honolulu, HI, USA, 2025, pp. 1575–1586.
S. Bergmann, F. Brand, and C. Riess, “Three forensic cues for JPEG AI images,” arXiv preprint, 2025.
M. A. Zaabi and A. S. AlShibli, “A review of JPEG file carving: Challenges, techniques, and future directions,” Applied Computing Journal, vol. 5, no. 1, pp 372–385, 2025.
