In general, data compression is the process of reducing a file’s size using specialized tools and methods. Almost any file can be compressed with data. A program, video, audio, image, or another type of file could be the file. According to Casey (2011), this is done to conserve bandwidth or hard drive space when streaming media files are used. Both compressed and uncompressed data can be contained in a compressed file.
Data compression comes in various forms and there exist differences between a compressed and an uncompressed file. This article today will have a look at the two basic types of data compression, as well as how data compression takes place and the implications it’s got on forensics.
With that said, let’s have a rundown of all you need to know.
WHAT ARE THE TYPES OF DATA COMPRESSION?
- Lossy File Compression
An algorithmic approach is used in Lossy file compression, which results in data loss. To put it another way, a file that has been decompressed back to its original state will not be identical and will have lost data. Lossy data compression can be seen in formats like MPG and JPEG (Ladino, n.d.).
- Lossless Compression
The algorithm used in lossless file compression does not cause any data to be lost. In other words, the file’s quality would not be affected by the compression, and it would remain identical to the original, with the exception of its smaller size. The decompression would return the file to its original size and quality after compression.
The LZW method is one of the most widely used lossless compression techniques. The deflate method is a variant of the LZW method that is slightly faster-optimized. The Deflate technique is used by WinZip, Alsip, and most other compression tools. A modified version of Deflate is utilized by WinRAR, the most widely used commercial file compression software (Ladino, n.d.).
HOW DOES DATA COMPRESSION WORK?
The LZW calculation works by putting away and referring to tedious examples in the record through its underlying information word reference. As a result, a particular piece of information that appears repeatedly throughout the file does not need to be stored individually; instead, it is replaced by merely a reference.
Documents and monochrome image files like GIF (Graphical Interchange Format) and TIFF (Tagged Image File Format) benefit most from this algorithm.
WHAT ARE THE EFFECTS OF COMPRESSED FILES IN?
A document that is compressed on a computer will remain compressed until it is deleted. In this way, scanning a plate for a watchword that exists in the compacted document which has been erased wouldn’t yield any outcome. A search for a file header would be unsuccessful because the length of the information is preceded by all data in a compressed file. When conducting an investigation involving deleted compressed files, the digital forensic investigator must select a tool that is compatible with the compressed files. Examples include Encase Forensic).
A compressed file wouldn’t look the same if the tool doesn’t support that. Using the WinZip compression tool, for instance, a 64 Kb file was reduced to a 12 Kb file. When compressed, the file, let’s say, takes up 10 clusters (clusters are a unit of allocable storage space on a hard disk). The 64 Kb file would be reported to belong to 10 clusters by the MFT record, despite the fact that it is not and is a slack space in the area around it.
