Byte-level generative predictions for forensics multimedia carving

TL;DR

This paper introduces a byte-level generative model called bGPT for reconstructing fragmented multimedia files in digital forensics, enabling better file recovery without relying solely on signatures.

Contribution

It presents a novel generative approach using a byte-level transformer to predict missing data in multimedia fragments for forensic file carving.

Findings

Generative predictions improve fragment matching accuracy.

Metrics like SSIM and JSD evaluate prediction fidelity.

Model effectively predicts byte-level patterns for multimedia reconstruction.

Abstract

Digital forensic investigations often face significant challenges when recovering fragmented multimedia files that lack file system metadata. While traditional file carving relies on signatures and discriminative deep learning models for fragment classification, these methods cannot reconstruct or predict missing data. We propose a generative approach to multimedia carving using bGPT, a byte-level transformer designed for next-byte prediction. By feeding partial BMP image data into the model, we simulate the generation of likely fragment continuations. We evaluate the fidelity of these predictions using different metrics, namely, cosine similarity, structural similarity index (SSIM), chi-square distance, and Jensen-Shannon divergence (JSD). Our findings demonstrate that generative models can effectively predict byte-level patterns to support fragment matching in unallocated disk space.