The Data Carving - The Art of Retrieving Deleted Data as Evidence

Fatima Fatima, Erej Azeem

Abstract

This paper proposes an approach to extract hidden information as sensitive data can be hidden by the criminal in free space or slack space. But there might be cases when there exists no file system metadata information for file recovery. For this purpose, Data Carving techniques are used by forensic examiners. If a file is carved in a forensically sound manner, it is then acceptable in a court of law. Many automated tools exist to carve data out of a hard drive. In this paper, we looked at how to carve data in an old-fashioned way followed by carving data using tools.