Skip to main content
Article
An approach for the validation of file recovery functions in digital forensics' software tools
2014 6th International Conference on New Technologies, Mobility and Security - Proceedings of NTMS 2014 Conference and Workshops
  • Sultan Al Sharif, Abu Dhabi Police
  • Mohamed Al Ali, International Petroleum Investment Company
  • Naser Salem, Abu Dhabi Police
  • Farkhund Iqbal, Zayed University
  • May El Barachi, Zayed University
  • Omar Alfandi, Zayed University
Document Type
Conference Proceeding
Publication Date
1-1-2014
Abstract

Recovering lost and deleted information from computer storage media for the purpose of forensic investigation is one of the essential steps in digital forensics. There are several dozens of commercial and open source digital analysis tools dedicated for this purpose. The challenge is to identify the tool that best fits in a specific case of investigation. To measure the file recovering functionality, we have developed a validation approach for comparing five popular forensic tools: Encase, Recover my files, Recuva, Blade, and FTK. These tools were examined in a fixed scenario to show the differences and capabilities in recovering files after deletion, quick format and full format of a USB stick. Experimental results on selected commercial and open source tools demonstrate effectiveness of proposed approach. © 2014 IEEE.

Publisher
IEEE Computer Society
Disciplines
Keywords
  • Carving,
  • Deleted files,
  • Digital forensics,
  • File recovery,
  • Forensic tools,
  • Investigation
Scopus ID

84901419836

Indexed in Scopus
Yes
Open Access
No
https://doi.org/10.1109/NTMS.2014.6814005
Citation Information
Sultan Al Sharif, Mohamed Al Ali, Naser Salem, Farkhund Iqbal, et al.. "An approach for the validation of file recovery functions in digital forensics' software tools" 2014 6th International Conference on New Technologies, Mobility and Security - Proceedings of NTMS 2014 Conference and Workshops (2014) - 6
Available at: http://works.bepress.com/farkhund-iqbal/133/