Transformer-Based File Fragment Classification in Digital Forensics

This technical report presents a novel approach to file fragment type classification using a Transformer-based model, specifically the Swin Transformer V2 architecture, aimed at enhancing the accuracy and efficiency of digital forensics investigations. The report outlines the challenges faced in recovering fragmented data from incomplete or corrupted files, particularly in the context of cybercrime investigations. Traditional file carving methods often struggle with high volumes of fragmented data, necessitating more advanced techniques. The proposed model is trained to recognize complex patterns within raw byte sequences, significantly improving classification accuracy compared to traditional methods. The results demonstrate superior performance on the File Fragment Type dataset (FFT-75), indicating the model's effectiveness in automating the classification process. The report also discusses future work focusing on optimizing the model for various file block sizes and its application in real-world scenarios, thus providing a promising tool for digital forensics practitioners to enhance evidence recovery capabilities.