CS 558 Project Presentation. Automated Reassembly of File Fragmented Images Using Greedy Algorithms[N.Memon, A.Pal]

Transcription

1 CS 558 Project Presentation Automated Reassembly of File Fragmented Images Using Greedy Algorithms[N.Memon, A.Pal] Alberto E. Santiago Bob Meadows

2 Overview Problem statement Fragmentation Limitations of their approach Experimental results Implementation issues Future work

3 Problem Statement Whenever a file is normally deleted * from a computer hard disk, only the reference to the locations of the composing pieces of the file is dereferenced from the file allocation table. It is possible to recover this deleted data by processing the raw bytes still lingering in the storage medium. Although reconstruction may not be 100%, the recovered data may be enough to extract usable information. Our research focused on the reconstruction of deleted image files, particularly uncompressed bitmap images. * Information could be deleted by way of shredding, I which case recovery is almost impossible. Unix command 'shred'

4 How are images stored in disk The file systems attempts to contiguously store the file In the event contiguous allocation is not possible, the file becomes fragments. In most real world scenarios, an image will be fragmented when stored

5 How to go about restoring an image from fragmented data Assumtions All image data is present with no corruption All images are uncompressed Windows Bitmaps Image data is gathered in fragments the size of disk clusters. Identify header fragments For each fragment, we sort how good of a match it is to each other fragment. Use a greedy algorithm based on this sorting to recreate the image.

6 Problem Representation The reconstruction problem is represented as a k-vertex disjoint path problem on a directed graph Each vertex is represented by a fragment of an image and each edge E(i,j) is represented by the likelyhood that fragment j follows fragment i. The goal is find a hamiltonian path that uses the minimum (maximum) weight.

7 Fragment matching In order to reconstruct an image we have to know how well each fragment fits to every other fragment. In the paper this is accomplished using three different methods: Pixel Matching Sum of Differences Median Edge detection We call this result the candidate weight

8 Weight Methods Pixel Matching We take the last w bits of one fragment and first w bits of another fragment, where w is the width of an image. We pairwise AND the corresponing bits for both fragments we then count the equal bits. This value becomes the candidate weight of comparing these two fragments. Sum of Differences We take the absolute difference of the values for the pixels from two fragments. Median Edge detection We predict the pixels for the next fragment using N,E, NE pixel neighbors, we then compare the predicted pixels with the actual values of the pixels of candidate fragment using Sum of Differences.

9 Greedy heuristic All weights are stored in a matrix For each header a list of fragments is made that is sorted from most likely to least likely. The greedy choice for the reconstruction of the image is to extract the first fragment from the list and append it to the reconstructed set of fragments (the reconstructed set of fragments is the algorithms best guess of the right image)

10 Reconstruction Algoritms Greedy SUP Sequential Unique Path picks image header arbitrarily. Adds the best fragment to the reconstruction path, then removes it from the available list of fragments (It cannot be used by another image). The algorithm repeats this operation for subsequent headers. Drawback: The algorithm is heavily dependent of whichh header is chosen first. Greedy NUP Non-unique path - same as SUP only it does not remove the fragments once it uses them. Advantage: Image reconstruction is independent of the ordering in which headers are processed

11 Reconstruction Algorithm (cont'd) Greedy PUP Parallel unique path reconstructs all images in parallel, Taking the best candidate weight from the set of best candidates for each image header. Once a fragment is added to a reconstruction path, no other header can add it to its reconstruction path. Repeat the operation until all images are reconstructed Disadvantage: Any chosen fragment could be a better match for another fragment down the line Greedy SPF UP Shortest path first unique path this algorithm runs the NUP algorithm on all image headers. It then calculates the total weight of the reconstruction and for each image it divides the weight by the number of fragments in the image. The image with the best weight is all of the fragments marked as used and adds those fragments to its reconstruction path. It then repeats this for the remaining headers.

12 Enhanced Greedy Approach Chooses the best available fragment t, for fragment s, It then checks t's best predecessor b. If b = s, then t is the best match for s and it is added to s's reconstruction path. If b!= s, but b = t and t's best match is b then t is not the best succesor to s. The next best match for s is then evaluated. Advantage: Prevents the possibility of choosing a fragment that may be a better match for a fragment that has not yet being processed. Disadvantage: takes more time

13 Limitations for real world scenario Having all the data is not a realistic view Most images use compression schemes Non-image data is likely to be mixed in with the fragments For blocks of solid colors, the algorithm has a high chance of mismatching since many fragment will have good weights. Algorithm cannot reconstruct images whose width x pixel depth > fragment size

14 Suggestions for improvement Add alpha blending component so as to have 32 bit pixel representation

15 Results 720 x 540

16 Results 512 x 512

17 Results 404 x 600

18 Results 1024 x 768

19 Results 768 x 576

20 Conclusion Our rendition of this algorithm is able to construct images of varying depth and size. Image width and depth directly affect the cutoff bytes for fragment size. Larger widths imply lower quality reconstruction. Weight function based on Sum of Differences yields very good reconstruction Images with large portions of similar regions are difficult to recunstruct because of a large number of candidate fragments with similar weights.

21 Future Work Reconstruction with various header files in the fragment pool Implementation of the Advanced greedy approach Testing different weight functions