A method for reassembling a fragmented JPEG image from a collection of sectors of data consisting of a plurality of consecutive sectors of data (100, 200) loaded from a dump file, wherein at least some of the plurality of consecutive sectors of data comprises a respective restart marker value, the method comprising: a) among the plurality of consecutive sectors of data, locating a sector of data comprising a JPEG file signature, b) from the sector of data comprising the JPEG file signature and at least one consecutive sector of data, extracting a JPEG thumbnail corresponding to a JPEG image to be reassembled, c) from sectors of data consecutive to the sector of data comprising the JPEG file signature, determining sectors of data belonging to the JPEG image to be reassembled, and a first fragmentation point sector of data, wherein the first fragmentation point sector of data corresponds to a restart marker value, d) based on the restart marker value corresponding to the first fragmentation point sector of data, selecting a plurality of candidate sectors of data among said at least some of the plurality of sectors of data comprising a respective restart marker value, e) determining a continuation point sector of data by for each candidate sector of data, f) forming a candidate set of sectors of data by appending at least the candidate sector of data to the sectors of data belonging to the JPEG image to be reassembled, and g) calculating a fitness score for the candidate sector of data by using the candidate set of sectors of data and the JPEG thumbnail as parameters in a fitness function, h) selecting the candidate sector of data with a highest fitness score among the calculated fitness scores as a continuation point sector of data for determining further sectors of data belonging to the JPEG image to be reassembled, wherein the step f) comprises: from sectors of data consecutive to the candidate sector of data, determining sectors of data belonging to a same JPEG image, and a second fragmentation point sector of data, wherein the sectors of data belonging to the same JPEG image comprises the candidate sector, and forming the candidate set of sectors of data by appending the sectors of data belonging to the same JPEG image to the sectors of data belonging to the JPEG image to be reassembled, wherein steps d) - h) are repeated for the second fragmentation point sector of data and any further fragmentation points of data until all sectors of data belonging to the JPEG image to be reassembled has been determined. a) among the plurality of consecutive sectors of data, locating a sector of data comprising a JPEG file signature, b) from the sector of data comprising the JPEG file signature and at least one consecutive sector of data, extracting a JPEG thumbnail corresponding to a JPEG image to be reassembled, c) from sectors of data consecutive to the sector of data comprising the JPEG file signature, determining sectors of data belonging to the JPEG image to be reassembled, and a first fragmentation point sector of data, wherein the first fragmentation point sector of data corresponds to a restart marker value, d) based on the restart marker value corresponding to the first fragmentation point sector of data, selecting a plurality of candidate sectors of data among said at least some of the plurality of sectors of data comprising a respective restart marker value, e) determining a continuation point sector of data by for each candidate sector of data, f) forming a candidate set of sectors of data by appending at least the candidate sector of data to the sectors of data belonging to the JPEG image to be reassembled, and g) calculating a fitness score for the candidate sector of data by using the candidate set of sectors of data and the JPEG thumbnail as parameters in a fitness function, h) selecting the candidate sector of data with a highest fitness score among the calculated fitness scores as a continuation point sector of data for determining further sectors of data belonging to the JPEG image to be reassembled, from sectors of data consecutive to the candidate sector of data, determining sectors of data belonging to a same JPEG image, and a second fragmentation point sector of data, wherein the sectors of data belonging to the same JPEG image comprises the candidate sector, and forming the candidate set of sectors of data by appending the sectors of data belonging to the same JPEG image to the sectors of data belonging to the JPEG image to be reassembled, wherein steps d) - h) are repeated for the second fragmentation point sector of data and any further fragmentation points of data until all sectors of data belonging to the JPEG image to be reassembled has been determined.