Force Open: Lightweight black box file repair

Karl Wust; Petar Tsankov; Sasa Radomirovic; Mohammad Torabi Dashti

doi:10.1016/j.diin.2017.01.009

Force Open: Lightweight black box file repair

Karl Wust (Lead / Corresponding author), Petar Tsankov, Sasa Radomirovic, Mohammad Torabi Dashti

Computing

Research output: Contribution to journal › Article › peer-review

1 Citation (Scopus)

229 Downloads (Pure)

Abstract

We present a novel approach for automatic repair of corrupted files that applies to any common file format and does not require knowledge of its structure. Our lightweight approach modifies the execution of a file viewer instead of the file data and makes use of instrumentation and execution hijacking, two techniques from software testing. It uses a file viewer as a black box and does not require access to its source code or any knowledge about its inner workings. We present our implementation of this approach and evaluate it on corrupted PNG, JPEG, and PDF files.

Original language	English
Pages (from-to)	S75-S82
Number of pages	8
Journal	Digital Investigation
Volume	20
Issue number	Suppl.
Early online date	21 Mar 2017
DOIs	https://doi.org/10.1016/j.diin.2017.01.009
Publication status	Published - Mar 2017
Event	DFRWS EU/IMF 2017 - Lake Constance, Parkhotel St. Leonhard, Uberlingen, Germany Duration: 21 Mar 2017 → 23 Mar 2017 http://dfrws.org/conferences/dfrws-eu-2017 (Link to Conference website)

Keywords

File repair
Execution hijacking
Black box testing
Program instrumentation

Access to Document

10.1016/j.diin.2017.01.009Licence: CC BY-NC-ND

Publisher final version
©2017 The Author(s). Published by Elsevier Ltd on behalf of DFRWS. This is an open access article under the CC BY-NC-ND license ( http://creativecommons.org/licenses/by-nc-nd/4.0/
Final published version, 559 KBLicence: CC BY-NC-ND

Cite this

@article{125465594b404ea18fd400329f8896e6,

title = "Force Open: Lightweight black box file repair",

abstract = "We present a novel approach for automatic repair of corrupted files that applies to any common file format and does not require knowledge of its structure. Our lightweight approach modifies the execution of a file viewer instead of the file data and makes use of instrumentation and execution hijacking, two techniques from software testing. It uses a file viewer as a black box and does not require access to its source code or any knowledge about its inner workings. We present our implementation of this approach and evaluate it on corrupted PNG, JPEG, and PDF files.",

keywords = "File repair, Execution hijacking, Black box testing, Program instrumentation",

author = "Karl Wust and Petar Tsankov and Sasa Radomirovic and Dashti, {Mohammad Torabi}",

note = "No funding info; DFRWS EU/IMF 2017 ; Conference date: 21-03-2017 Through 23-03-2017",

year = "2017",

month = mar,

doi = "10.1016/j.diin.2017.01.009",

language = "English",

volume = "20",

pages = "S75--S82",

journal = "Digital Investigation",

issn = "1873-202X",

publisher = "Elsevier",

number = "Suppl.",

url = "http://dfrws.org/conferences/dfrws-eu-2017",

}

TY - JOUR

T1 - Force Open

T2 - DFRWS EU/IMF 2017

AU - Wust, Karl

AU - Tsankov, Petar

AU - Radomirovic, Sasa

AU - Dashti, Mohammad Torabi

N1 - No funding info

PY - 2017/3

Y1 - 2017/3

N2 - We present a novel approach for automatic repair of corrupted files that applies to any common file format and does not require knowledge of its structure. Our lightweight approach modifies the execution of a file viewer instead of the file data and makes use of instrumentation and execution hijacking, two techniques from software testing. It uses a file viewer as a black box and does not require access to its source code or any knowledge about its inner workings. We present our implementation of this approach and evaluate it on corrupted PNG, JPEG, and PDF files.

AB - We present a novel approach for automatic repair of corrupted files that applies to any common file format and does not require knowledge of its structure. Our lightweight approach modifies the execution of a file viewer instead of the file data and makes use of instrumentation and execution hijacking, two techniques from software testing. It uses a file viewer as a black box and does not require access to its source code or any knowledge about its inner workings. We present our implementation of this approach and evaluate it on corrupted PNG, JPEG, and PDF files.

KW - File repair

KW - Execution hijacking

KW - Black box testing

KW - Program instrumentation

U2 - 10.1016/j.diin.2017.01.009

DO - 10.1016/j.diin.2017.01.009

M3 - Article

SN - 1873-202X

VL - 20

SP - S75-S82

JO - Digital Investigation

JF - Digital Investigation

IS - Suppl.

Y2 - 21 March 2017 through 23 March 2017

ER -

Force Open: Lightweight black box file repair

Abstract

Keywords

Access to Document

Fingerprint

Cite this