Forensic Analysis of Document Fragment Based on SVM

The ability to automatically classify document fragments based on their contents is important in digital forensics. This paper proposes an Enhanced String Kernel (ESK) to classify file header fragments with Support Vector Machine (SVM). ESK can extract a byte sequence feature map about document fragment. The map consists of byte-level patterns of document fragments, and captures the characteristic of document fragments. An extended suffix array (ESA) data structure is presented to efficiently store and manipulate the feature map. We can compute the ESK by using the feature map. This method can efficiently categorize a variety of different systems and application file header fragment types. Experiments have provided good classification performance results about file header fragments.