Browse > Article
http://dx.doi.org/10.3745/KTSDE.2021.10.10.421

Forensic Analysis of HEIF Files on Android and Apple Devices  

Kwon, Youngjin (고려대학교 컴퓨터학과 정보보호융합전공)
Bang, Sumin (고려대학교 정보보호대학원)
Han, Jaehyeok (고려대학교 정보보호대학원)
Lee, Sangjin (고려대학교 정보보호대학원)
Publication Information
KIPS Transactions on Software and Data Engineering / v.10, no.10, 2021 , pp. 421-428 More about this Journal
Abstract
The High Efficiency Image File Format (HEIF) is an MPEG-developed image format that utilizes the video codec H.265 to store still screens in a single image format. The iPhone has been using HEIF since 2017, and Android devices such as the Galaxy S10 have also supported the format since 2019. The format can provide images with good compression rates, but it has a complex internal structure and lacks significant compatibility between devices and software, making it not popular to replace commonly used JPEG (or JPG) files. However, despite the fact that many devices are already using HEIF, digital forensics research regarding it is lacking. This means that we can be exposed to the risk of missing potential evidence due to insufficient understanding of the information contained inside the file during digital forensics investigations. Therefore, in this paper, we analyze the HEIF formatted photo file taken on the iPhone and the motion photo file taken on the Galaxy to find out the information and features contained inside the file. We also investigate whether or not the software we tested support HEIF and present the requirement of forensic tools to analyze HEIF.
Keywords
H.265; HEIF; HEIC; Motion Photo; Digital Forensics;
Citations & Related Records
연도 인용수 순위
  • Reference
1 U. Albalawi, S. P. Mohanty, and E. Kougianos, "A hardware architecture for better portable graphics (bpg) compression encoder," In 2015 IEEE International Symposium on Nano-electronic and Information Systems, pp.291-296, 2015.
2 J. Alakuijala, "WebP Lossless Bitstream Specification," 2012, [Internet], https://developers.google.com/speed/webp/docs/webp_lossless_bitstream_specification.
3 G. K. Wallace, "The JPEG still picture compression standard," IEEE Transactions on Consumer Electronics, Vol.38, No.1, pp.18-34, 1992.   DOI
4 Information technology - high efficiency coding and media delivery in heterogeneous environments. Standard, International Organization for Standardization, Geneva, CH, December 2017.
5 "HEIF Image Format," nokiatech.github.io, accessed JUL 7, https://nokiatech.github.io/heif/technical.html.
6 S. McKeown and G. Russell, "Forensic considerations for the high efficiency image file format (heif)," In 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), IEEE, pp.1-8. 2020.
7 "MAGNET FORENSICS," Magnet Forensics Blog, Last Modified JAN 25. 2021, accessed MAR 20. 2021, [Internet], https://www.magnetforensics.com/blog/android-motion-photos-in-magnet-axiom/
8 "High Efficiency Image File (HEIF) Format, MPEG-H Part 12," loc.gv, last modified JUN 17. 2021, accessed JUL 5, [Internet], https://www.loc.gov/preservation/digital/formats/fdd/fdd000525.shtml
9 "Counterpoint," Counterpoint Research, Last Modified APRIL 30. 2021, accessed JUNE 24. 2021, [Internet], https://www.counterpointresearch.com/global-smartphone-share/
10 M. J. Bennett, "Assessing the potential useof high efficiency video coding (hevc) and high efficiency image file format (heif) in archival still images," Code4Lib Journal, Vol.41, 2018.