An Investigation on File Carving Tool Methodologies Using Scenario Based Image Creation
Hepi Suthar, Priyanka Sharma · Indian Journal of Science and Technology · 2024
Objectives: The objective of this study is to develop and validate carving techniques and tools for recovering fragmented files in digital forensics, using various data sets (Data recovery done from various SSD for investigation environment) to verify effectiveness and contribute to the advancement of the field. Methods: The research method used in this study involves the development and validation of carving techniques and tools that can effectively retrieve data from fragmented files. The study uses various data with the use of scenario based from different research organizations to verify the effectiveness of the developed carving techniques and tools. Here this study based on foremost tool, the study also creates 16 pictures for tool verification depending on situations and uses a well-known commercial carving tool, Foremost, to demonstrate the developed image carving pace and precision of each media. The research method is focused on functional verification and creating solutions for digital forensics. Findings: The research findings of this study indicate that the data recovery (from solid state drive) of fragmented files is a significant challenge for file carving (Tools - Scalpel, Bulk Extractor, Foremost, and Photorec) in digital forensics. The study highlights the need for developing and validating carving techniques and tools that can effectively retrieve data from fragmented files. The data sets (Data recovery done from various SSD for investigation environment) from different research organizations were used to verify the effectiveness of the developed carving techniques and tools. The study creates 16 pictures for tool verification depending on situations and uses Foremost (Forensic Tool), a well-known commercial carving tool, to demonstrate the developed image carving pace and precision of each media. The study also found that various carving techniques and tools are constantly being created to get around these restrictions. However, the current data sets (Data recovery done from various SSD for investigation environment) are less useful for validating tools due to their constrained environmental circumstances. Therefore, the study recommends the use of more realistic data sets (Data recovery done from various SSD for investigation environment) to validate carving techniques and tools. Overall, the study\'s findings contribute to the advancement of digital forensics by providing a more efficient and reliable solution for recovering data from fragmented files. The study\'s results can be used to improve the accuracy and effectiveness of file carving techniques and tools, thus enhancing digital forensic investigations. Novelty: The novelty of this research lies in developing and validating carving techniques and tools for effectively retrieving data from fragmented files in digital forensics. Like various scenario tested with forensic tools likes Scalpel, Bulk Extractor, Foremost, and Photorec. And tested based on various file signature (document, audio, video, email, and archive). Here file carving technique major with this linearly stored file carving performance, deleted files, file carving performance stored non-linearly, non-linearly, Master Boot Recorder, GUID Partition Table, Hard Disk Drive, and Solid State Drive. Keywords: SSD, Digital Forensics, File Carving, HDD, Data Recovery