An approach for the validation of file recovery functions in digital forensics' software tools
Source of Publication
2014 6th International Conference on New Technologies, Mobility and Security - Proceedings of NTMS 2014 Conference and Workshops
Recovering lost and deleted information from computer storage media for the purpose of forensic investigation is one of the essential steps in digital forensics. There are several dozens of commercial and open source digital analysis tools dedicated for this purpose. The challenge is to identify the tool that best fits in a specific case of investigation. To measure the file recovering functionality, we have developed a validation approach for comparing five popular forensic tools: Encase, Recover my files, Recuva, Blade, and FTK. These tools were examined in a fixed scenario to show the differences and capabilities in recovering files after deletion, quick format and full format of a USB stick. Experimental results on selected commercial and open source tools demonstrate effectiveness of proposed approach. © 2014 IEEE.
IEEE Computer Society
Carving, Deleted files, Digital forensics, File recovery, Forensic tools, Investigation
Al Sharif, Sultan; Al Ali, Mohamed; Salem, Naser; Iqbal, Farkhund; El Barachi, May; and Alfandi, Omar, "An approach for the validation of file recovery functions in digital forensics' software tools" (2014). All Works. 418.
Indexed in Scopus