A method to identify the AVI-type blocks based on their four-character codes and C4.5 algorithm

Video file carving is crucial to computer forensics and very challenging for researchers. Identification of related data plays a key role in video file carving. Most researches on this topic rely on statistical analysis by establishing a machine learning model. However, they didn´t show good performance on video data. It is almost impossible to give a general method to classify all kinds of file blocks due to different characteristics between file blocks. In this paper, we focus on AVI files. AVI files are one of widely used video format, especially in camera. We describe the framework of video file carving and propose a method to identify AVI-type blocks for a range of relevant file block types, which is based on the four-character codes of the structure of AVI and applies the C4.5 algorithm. The experiments achieve a high true positive rate after these blocks are classified twice. In addition, we also make an outlook for subsequent work in video file carving.