A study on multimedia file carving method

File carving is a method that recovers files at unallocated space without any file information and used to recover data and execute a digital forensic investigation. In general, the file carving recovers files using the inherent header and footer in files or the entire file size determined in the file header. The largely used multimedia files, such as AVI, WAV, and MP3, can be exactly recovered using an internal format in files as they are continuously allocated. In the case of the NTFS, which is one of the most widely used file system, it supports an internal data compression function itself, but the NTFS compression function has not been considered in file carving. Thus, a large part of file carving tools cannot recover NTFS compressed files. Also, for carving the multimedia files compressed by the NTFS, a recovery method for such NTFS compressed files is required. In this study, we propose a carving method for multimedia files and represent a recovery plan for deleted NTFS compressed files. In addition, we propose a way to apply such a recovery method to the carving of multimedia files.     

PACKTER: implementation of internet traffic visualizer and extension for network forensics

Traffic visualization tools help network operators to maintain awareness of the status of a network, including anomalous activities. Unfortunately, the network operator may look away from the visualizer when beginning network forensics, such as launching a terminal application, logging into a server, and analyzing log files. Thus, the eyesight of the network operator will move from the visual screen even if valuable information is displayed. Our motivation is to develop the ability to use visualization tools as a network operation console. Whereas previous tools focused on outputting packet information, we herein extend the visualizer to accept inputting for operators to start their operations. Since little such software exists for our intent, we develop PACKTER, which is able to visualize traffic based on per-packet information in real time. We also extend PACKTER to have a function of negotiating to a network forensic system, which allows the operator to select an individual packet using a mouse, to start network forensics using a keyboard, and to receive results without looking away from the PACKTER viewer.     

The implementation of the ecosystem module of a coastal environmental model: Port Phillip Bay,Australia

When implemented as a computer program, an ecosystem model is only a part of a larger programming environment. This programming environment includes other programs, non-model program components, program design rules, data files, and associated analysis analytical tools. These components should be divided to allow programmers to focus on their areas of expertise, but must then be rejoined in such a way as to minimise debugging and execution overheads. We describe this larger programming environment as it surrounds a model of the ecosystem of Port Phillip Bay, Australia.The ecosystem model requires a transport model to allow spatial modelling; this transport model uses currents from a computationally intensive hydrodynamic model. Implementation of the ecosystem model also requires non-model code, such as routines to initialise parameters or the integration method. Their design determines program reliability and performance. A modular structure allows different parts of the model to be independently modified; this makes for efficient programming. We describe formal design rules used to enhance readability and information content of the model's parameter names. To execute, the model must access data files and a record of the run must be kept — a Unix shell program serves both these functions. The data files may require software tools for generation or manipulation. Output from the model also requires post-processing for visualisation and analysis. The model is thus only a part of a network of software, whose development must be coordinated to ensure reliability and efficiency.     

Interactive publication: The document as a research tool

The increasing prevalence of multimedia and research data generated by scientific work affords an opportunity to reformulate the idea of a scientific article from the traditional static document, or even one with links to supplemental material in remote databases, to a self-contained, multimedia-rich interactive publication. This paper describes our concept of such a document, and the design of tools for authoring (Forge) and visualization/analysis (Panorama). They are platform-independent applications written in Java, and developed in Eclipse¹ using its Rich Client Platform (RCP) framework. Both applications operate on PDF files with links to XML files that define the media type, location, and action to be performed. We also briefly cite the challenges posed by the potentially large size of interactive publications, the need for evaluating their value to improved comprehension and learning, and the need for their long-term preservation by the National Library of Medicine and other libraries.     

Cryptography: all-out attacks or how to attack cryptography without intensive cryptanalysis

This article deals with operational attacks leaded against cryptographic tools. Problem is approached from several point of view, the goal being always to retrieve a maximum amount of information without resorting to intensive cryptanalysis. Therefore, focus will be set on errors, deliberate or not, from the implementation or the use of such tools, to information leakage. First, straight attacks on encryption keys are examined. They are searched in binary files, in memory, or in memory files (such as hibernation files). We also show how a bad initialization on a random generator sharply reduces key entropy, and how to negate this entropy by inserting backdoors. Then, we put ourselves in the place of an attacker confronted to cryptography. He must first detect such algorithms are used. Solutions for this problem are presented, to analyze binary files as well as communication streams. Sometimes, an attacker can only access encrypted streams, without having necessary tools to generate such a stream, and is unable to break the encryption used. In such situations, we notice that it often remains information leakages which appear to be clearly interesting. We show how classic methods used in network supervision, forensics and sociology while studying social networks bring pertinent information. We build for example sociograms able to reveal key elements of an organization, to determine the type of organization, etc. The final part puts in place the set of results obtained previously through the analysis of a closed network protocol. Packet format identification relies on the behavioural analysis of the program, once all the cryptographic elements have been identified.     

A robust and efficient spatial data structure

A new structure for organizing a set of multidimensional points called the nested interpolation-based grid file (NIBGF) is introduced. The structure represents a synthesis and an improvement over interpolation-based grid files (IBGF), BANG files, andK-D-B-trees. It decomposes the data search space into uniquely identifiable regions which may either be disjoint as in interpolation-based grid files or enclose each other as in the BANG files. In addition to possessing the symmetry of access and clustering properties characteristic of grid file structures, the performance of NIBGF is comparable to aB-tree performance as far as the index is concerned, even in the worst case scenario, and to the BANG file performance as far as the data regions are concerned. These properties make the new structure suitable for efficient implementation of relational database operations.Research supported by NSF IRI-9010365     

继电保护装置意外掉电的保护措施研究

继电保护装置在更新参数时需要保存文件,当在写文件过程中意外断电,会引起写参数文件错误,重新上电后参数文件错误可能导致设备死机等无法预料的后果。针对这一问题,提出了两种解决方案:备份文件方式和高可靠性文件系统。详细阐述了两者的实现方法,并对其效果和优劣做了对比。提出的两种方法可以在装置意外掉电时保证参数文件可用,从而避免设备死机,提高装置可靠性。     

Spotting the difference

Source Code Management (SCM) is a valuable tool in software development projects, providing the ability to store and retrieve past versions of source files. Comparison tools offer the capability to compare different files or versions, highlighting their differences. Most such tools are built around a two‐pane interface, with files displayed side by side. Such interfaces are inefficient in the use of horizontal screen space, and ineffective since duplication makes text more difficult to read, leaving most of the comparison burden to the user. In this article we introduce an innovative metaphor for comparison interfaces. Based on a single‐pane interface, common text is displayed only once with differences intelligently combined into a single text, improving readability. To further improve usability, additional features were developed: difference classification (additions, deletions, and modifications); fine level of granularity; special features to display modifications; and intelligent white space handling. A usability study conducted among 16 participants using real‐world samples demonstrated the interface adequacy: on average, participants were 60% faster in performing comparison tasks, while the quality of answers improved by almost 80% on our scale. After the experiment, the proposed interface was declared the favorite choice by all participants. Copyright © 2010 John Wiley & Sons, Ltd.     

Toward the Semantic Desktop: The seMouse Approach

Modern computers have enjoyed increasing storage capacity, but the mechanisms that harness this storage power haven't improved proportionally. Whether current desktops have scaled to handle the enormous number of files computers must handle compared to just a few years ago is doubtful at best. Scalability includes not only fault tolerance or performance stability of tools for users to harness this power. The lack of appropriate structures and tools for locating, navigating, relating, and sharing bulky file sets is preventing users from harnessing their PCs' full storage power. Powering desktops with metadata, leading to the semantic desktop, is a promising way to realize this potential. The seMouse approach realizes the promising vision of the semantic desktop. This approach provides seamless integration between file-centered tooling and semantically aware, resource-centered applications.     

一种基于VBA的通用Office文档转换方法

对于微软的办公软件Office平台的各种文件系统的相互转换不仅有理论价值,而且有其现实意义,如Word和普通文本文件,Word和Excel,Word和PowerPoint文件之间的格式和内容的转换,Office文档和HTML格式的转换都很重要,这里给出一种通用的转换软件开发方法,可以使一般的用户开发出自己需要的文件转换工具。     

基于统计结果的文件I/O优化*

对目前主流操作系统的文件大小分布和空间占用、网络文件服务环境下的文件读取请求和视频下载点播等典型应用进行了统计分析,总结了对交换文件、小尺寸文件和访问集中文件进行优化的必要性和可行性.基于目前已有的存储器件,提出了基于统计结果的混合加速外存储体系结构及相应的调度算法.实验结果表明,可以缩短I/O响应时间,提高传输率,改善系统性能.     

基于混沌序列的数据加密算法设计与实现

从理论上分析了混沌序列加密方式、密钥流产生方法、密钥空间大小 ;提出了基于 L ogistic混沌序列的数据加密模型 ;通过对混沌序列加密算法的设计 ,提高了运算速度 ;算法分析表明该算法具有很强的抗密钥穷举攻击和抗选择明文攻击的能力 .作者采用微软公司 VS.Net开发工具设计了基于混沌序列的数据加密软件 (Sm artdog) ,该软件适合于任何数据文件的加密 ;并将混沌加密算法与常用加密算法 DES、RSA进行了比较 .     

数码图像合成中的抠图方法与技巧

在数码图像合成的实际操作中,最难的就是在图像文件中选择抠出需要操作的部分。如果要想精确而又高效地完成两张或多张复杂的数码图像的合成,使用单一的抠图方法是远远不够的,则要结合实际情况,选择合适的工具,共同使用,互为补充,以此来获得复杂的选区效果,使设计者的创意能够更好地发挥。     

多计算机间的文件并行传输服务:MPI-TFTS

在异构环境中,计算机间快速、安全、可靠的文件传输是非常必要,然而很多基于MPI的分布式并行开发环境没有提供计算机间的文件并行传输服务。提出了一种基于MPI的支持多种传输工具的文件并行传输服务：MPI-TFTS（message application interface tools filetransfer service）,MPI—TFTS采用三层体系结构,集成多种传输工具,使得其可以用MPI通信原语,现有的传输工具进行文件并行传输,在环境条件确定的情况下,用户可以选择更好的传输工具来减少文件传输时间,最后给出了两种文件传输服务的并行实施。     

3G 院线业务应用层的性能优化

提出了对Web性能前端进行改进的方法。3G院线网站开发完成以后,无论是通过管理员的使用,还是Yslow工具的分析,都表明该网站性能较低。整个网站加载速度慢,加载文件多。针对这一缺点,对3G院线网站进行了改进。主要是减少HTTP请求数、对文件进行压缩传输和在浏览器中对文件进行缓存来达到提高网站访问性能。     

Automated generation of computationally hard feature models using evolutionary algorithms

A feature model is a compact representation of the products of a software product line. The automated extraction of information from feature models is a thriving topic involving numerous analysis operations, techniques and tools. Performance evaluations in this domain mainly rely on the use of random feature models. However, these only provide a rough idea of the behaviour of the tools with average problems and are not sufficient to reveal their real strengths and weaknesses. In this article, we propose to model the problem of finding computationally hard feature models as an optimization problem and we solve it using a novel evolutionary algorithm for optimized feature models (ETHOM). Given a tool and an analysis operation, ETHOM generates input models of a predefined size maximizing aspects such as the execution time or the memory consumption of the tool when performing the operation over the model. This allows users and developers to know the performance of tools in pessimistic cases providing a better idea of their real power and revealing performance bugs. Experiments using ETHOM on a number of analyses and tools have successfully identified models producing much longer executions times and higher memory consumption than those obtained with random models of identical or even larger size.     

Geo — EAS (Geostatistical Environmental Assessment Software)

Geo-EAS (Geostatistical Environmental Assessment Software) is a collection of public-domain interactive software tools for performing two-dimensional geostatistical analyses of spatially distributed data. The principal functions of the package are the production of 2-dimensional grids and contour maps of interpolated (kriged) estimates from sample data. Other functions include data preparation, data maps, univariate statistics, scatter plots/linear regression, and variogram computation and model fitting. Extensive use of data graphics such as maps, histograms, scatter plots and variograms help the user search for patterns, correlations, and problems in a data set. Data maps, contour maps, and scatter plots can be plotted on a pen plotter. Individual programs can be run independently; the statistics and graphics routines may prove useful even when a full geostatistical study is not appropriate. For ease of use, the programs are controlled interactively through screen menus, and use simple ASCII data files which may be prepared with any text editor.     

控制访问驱动器或文件夹的一种技术

计算机普及之后,以计算机病毒、非法存取等为代表的计算机安全问题成为了信息安全的新热点。人们研制各种反病毒的工具,并采用多种有效的身份识别和访问控制机制。针对公用计算机,进行驱动器或文件夹的访问控制,保证个人信息具有保密性。提出了一种密码访问驱动器或文件夹的关键技术,采用Web、Flash与VB技术集成,实现了计算机用户密码访问驱动器或文件夹的需求。