In the framework of his research, Zhang (56) uses Color Map Pattern method to establish a correlation between pixels used for evidence and those in the original image. If as a result of the test, it will be possible to reconstruct the original image using the data that in the process of running the sequence was stored in an array. Colors in the array were stored as decimal values of RGB colors. Using the same sequence to restore the colors to the same places in order to create an image means that there is a certain pattern by which colors are written into dump memory. The researcher uses RGB mode because it represents the three colors that an average monitor uses to create all other colors from the color palette (Zhang and Xiao 27). Eight initial images were used in order to represent all possible interactions of these three colors.
This test was used in order to test the hypothesis of whether it is possible to create a forensically sound method of extracting information from GPU in the undamaged and unaltered state. Despite the hypothesis was not proved, Color Map Pattern test revealed that there is a clear correlation between evidence and the original data. The author managed to successfully map and extract data and reproduce it, though it was not an exact copy of the original because the color pattern was not the only data that is written to memory about the image.
Albabtain and Yang (16) have used Color Map Pattern for the same purpose, but they enhanced the sequence to read other image formats and recover data not only from images opened in image viewers but also from web pages.
Zhang’s work is a Master thesis where he attempts to discover a forensically sound method to recover the data about the image from an NVIDIA GPU. In order to do that, Zhang has created software that allows running several tests in order to request and store information directly from GPU. The first test checks the availability of such information. The second one checks its integrity. The third allows to locate the test image data on GPU and extract it from GPU memory. The recovery process was divided into three sections: recovery of color data, validating it against the original, and testing if such procedure could be used in different environments.
The results showed that it is possible to locate and access information on GPU memory in full volume without damaging it and even replicate its pattern. However, a certain number of such patterns needs to be recovered before it is possible to reconstruct the image. The forensic soundness of such a method was not proved due to the inability to repeat the results on the same image, which is explained by the method the data is stored in GPU. Nonetheless, a new test called Color Depth Map was elaborated in the process in order to restore the data from GPU by creating a number of image data conversion matrices. Unfortunately, as of yet the test cannot be called forensically sound. In the end, the author hopes that this new test with some modifications made in the future will be able to become forensically sound or at least guide the research in the right direction. The research is extremely topical due to the absence of reliable forensic methods of retrieving and researching data from GPU.
Works Cited
Albabtain, Yazeed, and Baijian Yang. “GPU Forensics: Recovering Artifacts from the GPUs Global Memory Using OpenCL.” The Third International Conference on Information Security and Digital Forensics in Greece, The Society of Digital Information and Wireless Communications (SDIWC), 2017, pp. 12-20.
Zhang, Qing, and Chunxia Xiao. “Cloud Detection of RGB Color Aerial Photographs by Progressive Refinement Scheme.” IEEE Transactions on Geoscience and Remote Sensing, vol. 52, no. 11, 2014, pp. 7264-7275.
Zhang, Yulong. Recovering Image Data from a GPU Using a Forensic Sound Method. Dissertation, Purdue University, 2015.