Single-byte-marker for Detecting JPEG JFIF Header Using FORIMAGE-JPEG

Header and footer detection is important in digital investigation for file type detection. The use of efficient algorithm to detect them is vital to reduce time taken for analyzing ever increasing data in hard drive or physical memory. Even though there are few applications developed e.g. Foremost, Scalpel; however the algorithm used for header detection is not discussed much. This paper introduces two algorithms: single-byte-marker and 20-point-reference for header detection. Few experiments have been done using image taken from Helix Live CD from 8 MB hard disk partition, 1 GB physical memory and raw data from DFRWS 2006 challenge.The results show that single-byte-marker algorithm is more efficient for header detection.