File Reconstruction in Digital Forensic

Sitompul, Opim Salim; Handoko, Andrew; Rahmat, R F

doi:10.12928/telkomnika.v16i2.8230

Cited by 9 publications

(6 citation statements)

References 12 publications

(13 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Such a timeline sometimes is called a Super Timeline. Sitompul, Handoko, & Rahmat [12] state that to have a clear view of events that occurred during a time period is challenging to achieve in digital investigation. Event reconstruction, which allows a digital investigator to understand the timeline of a crime, is one of the paramount steps of the digital investigation process [13].…”

Section: Literature Reviewmentioning

confidence: 99%

An Abstraction Based Approach for Reconstruction of TimeLine in Digital Forensics

Bhandari

Jusas

2020

Symmetry

View full text Add to dashboard Cite

Acquiring a clear perspective of events and artefacts that occur over time is a challenging objective to accomplish in digital forensics. Reconstruction of the timeline of events and artefacts, which enables digital investigators to understand the timeline of digital crime and interpret the conclusion in the form of digital evidence, is one of the most paramount and challenging tasks in digital forensics. This challenging task requires the analysis of immense amounts of events because of the explosive growth of the internet, interconnected devices, and innovative technology nowadays. Various approaches have been developed during the last decade, but most of them are not able to handle huge volumes of data, explore evidence, and enhance the understandability of timelines in a competent way to assist the investigator. For this purpose, we introduce a methodology backed by an abstraction concept and forensic tools that can support investigators during the reconstruction, understanding of the timeline of events and artefacts, and interpretation of evidence by tracing the activities performed by users of the typical computer system. The Java programming language is used to implement the proposed methodology, which is object-oriented and follows the symmetry definition in software. Generally, symmetry in software can be viewed as an invariant change that aims to preserve a specific property of the system, namely its structure, behaviour, regularity, similarity, familiarity and uniformity. Similarly, the abstraction-based methodology also permits us to follow the properties of symmetry. For instance, a uniform structure is stipulated for all the sources at the particular level of abstraction, such as the number of fields to be considered to provide the abstract level of timeline. The primary purpose of this approach is to assist with the analysis of the timeline in an optimum way. This paper illustrates the approach and then focuses on conceptual aspects of the methodology. The performed experiment shows that the proposed approach enhanced the analysis of the timeline.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

An Abstraction Based Approach for Reconstruction of TimeLine in Digital Forensics

Bhandari

Jusas

2020

Symmetry

View full text Add to dashboard Cite

show abstract

“…Keuntungannya, file yang dapat di-recovery lebih banyak karena area pencariannya meliputi seluruh area media penyimpanan. Namun, karena tidak melakukan analisis terhadap metada file system, maka metode carving tidak akan menemukan informasi seperti filename, timestamp, exist/deleted, fragmentasi, dsb [4], [5], [7], [15].…”

Section: Pendahuluanunclassified

Identifikasi dan Recovery File JPEG dengan Metode Signature-Based Carving dalam Model Automata

Ardiansyah¹,

Hardi²,

Gata³

2020

Komputika

View full text Add to dashboard Cite

Penggunaan format gambar JPEG semakin meningkat seiring dengan meningkatnya produksi foto digital yang dipicu oleh kemunculan smartphone dan perkembangan sosial media. Hal tersebut membuat file JPEG berperan penting dalam proses digital forensik, sehingga banyak metode identifikasi dan recovery file JPEG yang dikembangkan. Paper ini berusaha melihat proses data carving file JPEG dengan metode Signature-Based Carving, metode carving yang paling sederhana, dengan sebuah model diagram Finite State Automata, sebuah model algoritma dasar dalam teori komputasi.

show abstract

“…Wollaston et al, in their paper, compared the data recovery functions of two forensic suites and three standalone non-forensic commercial applications, with the result that all tools had a comparable performance with respect to data recovery functions [11]. Sitompul et al, propose an Aho-Corasick parsing technique to read file attributes from the master file table (MFT), in order to examine the file condition, with the result that the file reconstruction process on the file system was performed successfully in 87.50% and string matching process average time was 0.32 second [12]. Bansal et al, describe the various methods and tools to recover data from Harddisk, how data recovery tools work, in what situation the data can lose permanently, and in what conditions data can be recovered [13].…”

Section: Introductionmentioning

confidence: 99%

Computer Forensic Using Photorec for Secure Data Recovery Between Storage Media: a Proof of Concept

Pratama

2021

International Journal of Science, Technology & Management

View full text Add to dashboard Cite

Data plays the important role, so that data recovery and data security be prioritized. Computer users often lose their data due to personal errors or by attacks. Digital forensics has one sub-field called computer forensic, which has an important role in the process of secure data recovery. USB Flashdisk as the most widely used storage media has a probability of data loss. It is necessary to do computer forensic actions, especially secure data recovery, on it so that it can restore data securely to other media while protecting it by giving privilege root. In this research, computer forensic testing the 2781 files of various data formats that were erased on a 32 GB USB flash drive using Photorec. The media for collecting data recovery results using an Intel computer, 2 GB RAM, 1.8 GHz processor, the Linux operating system Xubuntu 20.04. Testing is carried out following the test scenarios that have been designed, then observed, recorded, and analyzed. Photorec places recovery data in 6 recup_dir subdirectories. Test results and analysis of the test results show that Photorec is a reliable tool for computer forensic, especially secure data recovery because it can restore 100% of data, accompanied by privilege root for all data recovery results, so they cannot be changed and deleted by an end-user without granted access.

show abstract

File Reconstruction in Digital Forensic

Abstract: Abstract

Cited by 9 publications

References 12 publications

An Abstraction Based Approach for Reconstruction of TimeLine in Digital Forensics

An Abstraction Based Approach for Reconstruction of TimeLine in Digital Forensics

Identifikasi dan Recovery File JPEG dengan Metode Signature-Based Carving dalam Model Automata

Computer Forensic Using Photorec for Secure Data Recovery Between Storage Media: a Proof of Concept

Contact Info

Product

Resources

About