Novel Similarity Measurements for Reassembling Fragmented Image Files

Reassembling fragmented image files is a useful technique to seize image evidence in digital forensics. A key problem of reassembly is how to measure the similarity between the fragments. Most of the measurements are based on the local similarity of the images. We analyze the impact of similarity patterns on the judgment of the adjacency of the fragments and conclude that the horizontal similarity has little help. According to this conclusion, we improve the median edge detector by replacing the horizontal similarity with the left and right diagonal similarity. Furthermore, we improve the sum of differences and Euclidean distance by replacing the mean/sum used in the two measurements with the median. Experimental results verify the analysis of similarity patterns and the improvements.