A Recovery Technique of PDF File in the Unit of Page


KIPS Transactions on Computer and Communication Systems, Vol. 6, No. 1, pp. 25-30, Jan. 2017
10.3745/KTCCS.2017.6.1.25,   PDF Download:
Keywords: Damaged PDF File, Page Object, PDF, PDF Object Tag, PDF Page, recovery, Digital Forensic
Abstract

The influence of the data deletion method which is one of anti-forensic techniques is substantial in terms of forensic analysis compared to its simplicity of the act. In academic world, recovery techniques on deleted files have been continuously studied in response to the data deletion method and representatively, the file system-based file recovery technique and file format based recovery technique exist. If there’s metadata of deleted file in file system, the file can be easily recovered by using it, but if there’s no metadata, the file is recovered by using the signature-based carving technique or the file format based recovery technique has to be applied. At this time, in the file format based recovery technique, the file structure analysis and possible recovery technique should be provided. This paper proposes the page recovery technique on deleted PDF file based on the structural characteristics of PDF file. This technique uses the tag value of page object which constitutes one page of PDF file. Object is extracted by utilizing each tag value as a kind of signature and by analyzing extracted object, the metadata of PDF file is recombined and then it’s reconfigured page by page. Recovering by page means that even if deleted PDF file is damaged, even some pages consisting of PDF file can be recovered. Generally, if the file system based file is not recoverable, deleted file is recovered by applying the signature based carving technique. The technique which we proposed in this paper can recover PDF files that are damaged. In the digital forensic perspective, it can be utilized to recover more data than previously.


Statistics
Show / Hide Statistics

Statistics (Cumulative Counts from September 1st, 2017)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article
[IEEE Style]
J. Jang, S. G. Bang, J. Han, S. J. Lee, "A Recovery Technique of PDF File in the Unit of Page," KIPS Transactions on Computer and Communication Systems, vol. 6, no. 1, pp. 25-30, 2017. DOI: 10.3745/KTCCS.2017.6.1.25.

[ACM Style]
Jeewon Jang, Seung Gyu Bang, Jaehyeok Han, and Sang Jin Lee. 2017. A Recovery Technique of PDF File in the Unit of Page. KIPS Transactions on Computer and Communication Systems, 6, 1, (2017), 25-30. DOI: 10.3745/KTCCS.2017.6.1.25.