Proposal / Submission Type
Peer Reviewed Paper
Start Date
17-5-2018 11:15 AM
End Date
17-5-2018 11:50 AM
Abstract
The purpose of this research is to apply a graphics processing unit (GPU) forensics method to recover video artifacts from NVIDIA GPU. The tested video specs are 512 x 512 in resolution for video 1 and 800 x 600 in resolution for video 2. Both videos are mpeg4 video codec. A VLC player was used in the experiment. A special program has been developed using OpenCL to recover 1) patterns that are frames consist of pixel values and 2) dump data from the GPU global memory. The dump data that represent the video frame were located using simple steps. The recovery process was successful. For 512 x 512 resolution video, the frames were partially recovered but it shows enough information for the forensics investigator to determine what was viewed last. The research indicates that it is harder, but not impossible, to obtain a viewable frame from higher-resolution video
Scholarly Commons Citation
Albabtain, Yazeed M. and Yang, Baijian, "Live GPU Forensics: The Process of Recovering Video Frames from NVIDIA GPU" (2018). Annual ADFSL Conference on Digital Forensics, Security and Law. 3.
https://commons.erau.edu/adfsl/2018/presentations/3
Included in
Computer Law Commons, Defense and Security Studies Commons, Forensic Science and Technology Commons, Information Security Commons
Live GPU Forensics: The Process of Recovering Video Frames from NVIDIA GPU
The purpose of this research is to apply a graphics processing unit (GPU) forensics method to recover video artifacts from NVIDIA GPU. The tested video specs are 512 x 512 in resolution for video 1 and 800 x 600 in resolution for video 2. Both videos are mpeg4 video codec. A VLC player was used in the experiment. A special program has been developed using OpenCL to recover 1) patterns that are frames consist of pixel values and 2) dump data from the GPU global memory. The dump data that represent the video frame were located using simple steps. The recovery process was successful. For 512 x 512 resolution video, the frames were partially recovered but it shows enough information for the forensics investigator to determine what was viewed last. The research indicates that it is harder, but not impossible, to obtain a viewable frame from higher-resolution video
Comments
Visit the Panel Session page