Computer Forensic Using Photorec for Secure Data Recovery Between Storage Media: a Proof of Concept

Abstract

Data plays the important role, so that data recovery and data security be prioritized. Computer users often lose their data due to personal errors or by attacks. Digital forensics has one sub-field called computer forensic, which has an important role in the process of secure data recovery. USB Flashdisk as the most widely used storage media has a probability of data loss. It is necessary to do computer forensic actions, especially secure data recovery, on it so that it can restore data securely to other media while protecting it by giving privilege root. In this research, computer forensic testing the 2781 files of various data formats that were erased on a 32 GB USB flash drive using Photorec. The media for collecting data recovery results using an Intel computer, 2 GB RAM, 1.8 GHz processor, the Linux operating system Xubuntu 20.04. Testing is carried out following the test scenarios that have been designed, then observed, recorded, and analyzed. Photorec places recovery data in 6 recup_dir subdirectories. Test results and analysis of the test results show that Photorec is a reliable tool for computer forensic, especially secure data recovery because it can restore 100% of data, accompanied by privilege root for all data recovery results, so they cannot be changed and deleted by an end-user without granted access.

Current Issues and Challenges with Scientific Validation of Digital Evidence

“…Social media, cloud networking and storage encryption methods and Internet of Things are few new technologies in the world of computer science and we all know that it takes a long time for any new field to mature into an exact science. In addition, each subject's beliefs and practices are contested and tested over time before being approved or disapproved based on established scientific criteria [35][36][37].…”

Data Recovery Comparative Analysis using Open-based Forensic Tools Source on Linux

“…including image storage, file data hashing, data visualization, and data carving on damaged images. However, most of these tools are paid for [5]. Due to the limited inspection features, the extracted data cannot be ported directly to the circuit to extract additional evidence.…”