The Evolution of File Carving [ The benefits and problems of forensics recovery ] [

Y ear by year, the number of computers and other digital devices being used is increasing. The recent Pew Research Center Globalization Review [1] showed that 26 of the 36 countries surveyed had increased their computer usage. This increase is occurring simultaneously with an increase in usage of other digital devices, such as cell phones. In fact, in the United States alone 81% of the population now owns a cell phone, which is a 20% increase compared to 2002. Some countries , including Russia, have shown upwards of a 50% increase in cell phone ownership. Computers are now one of many devices where digital data is stored. Devices such as cell phones, music players, and digital cameras all now have some form of internal storage or else allow data to be stored to external devices like flash cards, memory sticks, and solid-state devices (SSDs). With this huge increase in digital data storage, the need to recover data due to human error, device malfunction, or deliberate sabotage has also increased. Data recovery is a key component of the disaster recovery, forensics, and e-discovery markets. Digital data recovery can consist of both software and hardware techniques. Hardware techniques are often used to extract data from corrupted or physically damaged disks. Once the data has been extracted, software recovery techniques are often required to order and make sense of the data. In this article, we will be solely discussing software techniques for recovery of data with a focus on digital forensics. We will begin by providing a quick overview of traditional data recovery techniques and then describe the problems involved with such techniques. We then introduce the techniques involved in file carving.