An approach for the validation of file recovery functions in digital forensics' software tools

Document Type

Conference Proceeding

Source of Publication

2014 6th International Conference on New Technologies, Mobility and Security - Proceedings of NTMS 2014 Conference and Workshops

Publication Date

1-1-2014

Abstract

Recovering lost and deleted information from computer storage media for the purpose of forensic investigation is one of the essential steps in digital forensics. There are several dozens of commercial and open source digital analysis tools dedicated for this purpose. The challenge is to identify the tool that best fits in a specific case of investigation. To measure the file recovering functionality, we have developed a validation approach for comparing five popular forensic tools: Encase, Recover my files, Recuva, Blade, and FTK. These tools were examined in a fixed scenario to show the differences and capabilities in recovering files after deletion, quick format and full format of a USB stick. Experimental results on selected commercial and open source tools demonstrate effectiveness of proposed approach. © 2014 IEEE.

Publisher

IEEE Computer Society

Last Page

6

Disciplines

Computer Sciences

Keywords

Carving, Deleted files, Digital forensics, File recovery, Forensic tools, Investigation

Scopus ID

84901419836

Indexed in Scopus

yes

Open Access

no

Link to Full Text

Share

COinS