JPEG碎片恢复和修复一直是数字取证领域中的一个难点和热点问题,特别是在遇到JPEG文件的头部缺失或者损坏而导致其数据无法正常解码和显示时。提出一种头部缺失且无重启标记的JPEG文件碎片解码与显示问题的解决方法。首先提出了基于JPEG碎片数据的各种解码参数(哈夫曼表、图像宽度、量化表和采样因子等)的估算方法;其次对显示时出现的位置错位和颜色偏移问题提出了相应的调整算法。实验结果表明,本文方法能够正确有效地解码并显示没有头部与重启标记的JPEG文件碎片。

Recovering the incomplete fragments of a JPEG file is a challenge in the digital forensics field, especially in the case of where JPEG header is lost or damaged. In this paper,we present a method to decode and display JPEG file fragments whose header has been lost or damaged and its data doesn't include any restart marker. First, the decoding parameters (Huffman tables, image width, quantization tables, sampling factor)are estimated based on the fragment content; second, corresponding adjustment algorithms for the display problems about mismatched positions and colors are proposed. Experiments show that the proposed method can correctly decode and display the JPEG file fragments without header and RST marker.