Digital Forensic
According to eccouncil.org, “Digital forensic science is a branch of forensic science that focuses on the recovery and investigation of material found in digital devices related to cybercrime. Digital forensics is the process of identifying, preserving, analyzing, and documenting digital evidence.”
According to interpol.int, “The main goal of digital forensics is to extract data from the electronic evidence, process it into actionable intelligence and present the findings for prosecution. All processes utilize sound forensic techniques to ensure the findings are admissible in court.”
I will try to explain how to recover deleted data using FTK Imager, FTK Imager is a tool to create disk image data to help preview data and for imaging. FTK Imager can also be used to recover deleted data by looking at the image it generated.
When you open FTK Imager you will be greeted with with the window below:
Before we start to recover our data, there are 2 options you can choose, the first one by creating new image of the targeted drive or by simply add evidence items, for this tutorial I will choose the second option by simply click the icon under File tab, and choose physical drive and the drive that I want to check
- Physical Drive : this is your physical drive or hard drive.
- Logical Drive : is the drive that you see on your file explorer.
- Image file : are the image created by
create image fileoption under file.
After you clicked finish, physical drive will be created on the left as shown below:
When you clicked on the plus button you will see 2 options, the first one is partition and the second one is unpartitioned space, if you clicked on the plus button beside partition you will be greeted with noname and a tree symbol beside it, when you clicked on it you will see the following window:
You can see on file list there are root folder and unallocated space folder, lets just open the root folder because in it are all of our files. For this tutorial I will you an empty USB Drive with a couple of file in it.
As you can see there are a couple of files in it, lets open the DO NOT OPEN folder and see what’s in it.
As you can see there are absolutely nothing in this drive but one deleted file and that file named IMPORTANT.txt, you can see on this example the deleted file are mark by a x symbol, we can recover this file by simply right click on the file and choose export file, next just choose your desire location to store the recovered data, and click ok to confirm.
Get Ahda Akmalul Ilmi’s stories in your inbox
Join Medium for free to get updates from this writer.
That’s how you can recover your accidently deleted files or folders.
For forensic purposes you need to create a new image of any evidence hard drive you had, and make sure the data inside it cannot be altered.
This YouTube video will explain in more detail about how to use FTK Imager for forensic purposes: https://youtu.be/8Hrz5P2D6CA
Reference:
