Forensic tool will advance data recovery

New computer forensic tools will make it possible to recover more data from corrupted hard drives so long as the missing files haven't been overwritten.

New computer forensic tools will make it possible to recover more data from corrupted hard drives so long as the missing files haven't been overwritten.

Finding criminal data on cell phones and game consoles is tough

Tools designed to harvest images from disks even after they have been deleted from the file system can be adapted to seek other file formats including Word documents, says Nasir Memon, a professor at the Polytechnic Institute of New York University.

In research that he hasn't yet published, Memon says will show that techniques used to cull images can be adapted to find text files, a capability that would be attractive to businesses trying to salvage data that may be fragmented and dispersed across a corrupted drive.

The text tool will examine fragmented chunks of files that may be distributed across a disk and analyze their content to see which ones likely go together. "It looks at global differences, for example, Twain vs. Shakespeare. Syntax helps eliminate false positives," Memon says.

The tool is based on a recovery method known as SmartCarving that was discovered at NYU and is commercially sold by vendor DigitalAssembly, which was founded by former students of Memon.

SmartCarving can reclaim 10% to 15% of digital images that conventional forensic tools miss when trying to find files that have been deleted from the file registry, he says.

Traditional file recovery seeks a known header and footer for a file and gathers all the related data blocks in between. If the data blocks making up the file are fragmented, traditional tools crash when they hit a fragment of a different format that might be sandwiched between pieces of the file being sought, Memon says.

SmartCarving images involves drawing together data blocks from a single image that are arranged consecutively on a drive and linking them to other groups of data blocks based on whether they seem to blend using criteria such as pixel density and dimensions of the image.

In this way, it becomes possible to recover partial images when pieces are missing and to recover images when headers are missing, Memon says. "You look at what can be decoded and pick the best," he says.

The actual sorting is done by algorithms that graph data segments to see which are most like another based on preset criteria. The closer fragments fall on the graph, the better the fit they are considered to have.

Using the technique on photos can reassemble photos even if some of the image data is missing, resulting in a picture that has a band missing from it. The method can create approximate headers for image files as well, which results in gathering and reassembling enough pieces to recreate a version of the image that might not be as sharp as the original, Memon says.

New research adapts this technique to other file formats such as .doc files. It looks at the content in file fragments and classifies it based on syntactical similarities. This is akin to sorting a box of jigsaw puzzle pieces that contains the pieces for many puzzles so that all the pieces from each puzzle are put in separate boxes, Memon says. Each puzzle can then be assembled based on the shapes of the pieces and the image fragment printed on them.

Join the PC World newsletter!

Error: Please check your email address.

Tags SmartCarvingsecuritydigital forensicscorruption

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?