ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Optimistic decompression

From ForensicsWiki
Revision as of 01:52, 6 August 2012 by Simsong (Talk | contribs) (Created page with "Optimistic decompression is a digital forensics technique in which each byte of an input buffer is examined for the possibility of compressed data. If data is found that ''mig...")

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Optimistic decompression is a digital forensics technique in which each byte of an input buffer is examined for the possibility of compressed data. If data is found that might be compressed, a decompression algorithm is invoked to perform a trial decompression. If the decompressor does not produce an error, the decompressed data is processed. The decompressor is thus called optimistically---that is, with the hope that it might be successful.

Optimistic decompression is used as a tool to validate JPEGs that are produced by file carving. The approach can also be used for fragment reassembly carving by attempting to combine different combinations of fragments, looking for a combination that produces neither decompression errors nor visual discontinuities. This is the approach used by the Adroit file carver.

See Also