from SANS Institute: http://www.sans.org/reading_room/whitepapers/forensics/datacarving-concepts_32969Y.

has been cited by the following article:

• TITLE: Carving Thumbnail/s and Embedded JPEG Files Using Image Pattern Matching

  AUTHORS: Nurul Azma Abdullah, Rosziati Ibrahim, Kamaruddin Malik Mohamad

  KEYWORDS: Component; JPEG Image; Pattern Matching; File Carving; DFRWS 2006/07; Thumbnail

  JOURNAL NAME: Journal of Software Engineering and Applications, Vol.6 No.3B, April 11, 2013

  ABSTRACT: Images (typically JPEG) are used as evidence against cyber perpetrators. Typically the file is carved using standard patterns. Many concentrate on carving JPEG files and overlook the important of thumbnail in assisting forensic investigation. However, a new unique pattern is used to detect thumbnail/s and embedded JPEG file. This paper is to introduce a tool call PattrecCarv to recognize thumbnail/s or embedded JPEG files using unique hex patterns (UHP). A tool called PattrecCarv is developed to automatically carve thumbnail/s and embedded JPEG files using DFRWS 2006 and DFRWS 2007 datasets. The tool successfully recovers 11.5% more thumbnails and embedded JPEG files than PredClus.