Data Carving - The Art of Retrieving Deleted Data as Evidence
Keywords:
Digital Forensics, Hard disk forensics, Data Carving, File system, Autopsy, Forensic Explorer, Unallocated space, file signature, manual extractionAbstract
This paper proposes an approach to extract the hidden information as sensitive data can be hidden by the criminal in free space or slack space. But their might be cases when there exists no file system meta data information for file recovery. For this purpose Data Carving techniques are used by forensic examiners. If a file is carved in a forensically sound manner, it is then acceptable in the court of law. Many automated tools exist to carve data out of a hard drive. In this paper we looked on how to carve data in an old fashioned way followed by carving data using tools.
