What Is Forensic Data Recovery?

Forensic tools are auxiliary tools used to ensure the protection of the integrity and validity of evidence when investigating computer crimes. When conducting criminal investigations, the general on-site investigation phase requires the application of online forensics tools, hard disk duplicators, and mobile phone forensics tools to obtain local / remote data, and effective verification tools are used to fix the evidence in a timely manner; the laboratory evidence inspection phase is first restored and deleted , Repair damaged data, restore hidden files, scan encrypted files to decrypt files, verify whether the file signature is correct; the stage of evidence analysis is the most complicated, and you need to formulate a corresponding investigation plan based on the specific case, and select computer forensic tools in a targeted manner Compare, search, and analyze data sources to reconstruct the case.

The tools used in the field survey stage are mainly online forensics tools and some hardware digital forensics tools. According to legal procedures, collect online electronic data or obtain and fix electronic data stored on the media to ensure the originality, integrity, and validity of the collected data ^[1]

Compared with hardware forensics tools, the use of software tools such as digital forensics runs through the entire case investigation process. Forensic tool software is divided into two categories: single-function forensic tools and professional judicial analysis tools. The former mainly includes data recovery tools, password deciphering tools, log analysis tools, communication record analysis tools, email analysis tools, etc .; professional forensic tools mostly integrate the above functions, and can be used to discover, analyze, and display electronic evidence of crime.

Data recovery tool

When obtaining electronic data, use a hard disk duplicator to obtain physical-level data information, that is, to obtain all data information stored in storage devices such as hard disks, floppy disks, and flash memories. These electronic data are in addition to various user-created documents, user-protected documents (encrypted files, password-protected files, compressed files or hidden files), computer-created documents (system files, configuration files, backup files, temporary files, historical files, etc. ), And other data evidence (unallocated disk space, Slack space, deleted files, etc.) that may exist in other data areas. Direct or indirect clues related to the case III. Forensic tools and applications in the evidence inspection stage may be stored in any form of these spaces in the form of data. Data recovery tools can recover deleted files, recover data corruption to varying degrees, and present data in invisible areas. WinHex, Data Extractor, PC-3000, Easyrecover, Finaldata, R-stdio and the Data Compass software launched by the domestic efficiency source technology are all great tools for data recovery. In recent years, memory data recovery has been a hot topic in forensic technology research. Therefore, memory data restoration, recovery of formatted media data, support for multimedia file data recovery, and speed of data recovery are the main functions and performance indicators of the above software comparison.

Crypto Decryption Tool

When collecting electronic data involved in a case, you often encounter file encryption, which requires strong password cracking software. ElcomSoft is a professional password cracking company in Russia. Its products are widely recognized by the industry for its advanced technology, flexible use and powerful functions. Elcom Soft supports cracking of WinZip, WinRar, AcrobatPDF, Microsoft Office (1995 2007), Outlook, EFS, ICQ, Yahoo, MSN, Google Talk, WindowsNT / 2000 / XP and other commonly used encrypted files or systems. The new version also Supports cracking of encrypted backup files of WIFI and iPhone, iPad, BlackBerry. In addition to the common brute force and dictionary cracking methods, Elcomsoft can also customize the cracking parameters by the user, including the length of the cracked password, combination of digital words, known characters, etc., to shorten the cracking time. The Passware software of another very good password cracking company in Russia also has its unique advantages. It can not only intelligently scan encrypted files in the computer, quickly reset local and Windows administrator passwords, quickly crack MSWord and Excel files, restore BitLocker-generated files. Hard disk encryption keys, decryption of virtual disks, and the first in the industry to use CPU + GPU hybrid parallel operations to improve cracking speed. The password recovery tool PRTK (Password Recovery ToolKt) of American AccessData Corporation is also a good choice for password cracking.

Dedicated computer forensic tools

Dedicated computer forensic tools refer to software that provides law enforcement agencies with comprehensive and thorough computer data acquisition, analysis, and discovery capabilities. The analysis conclusions are recognized by the court.

Guidance EnCase is the earliest forensic tool developed, and it is also the most widely used computer forensic tool. It has the functions of evidence acquisition, processing, in-depth forensic analysis, and case filing. It has always been known for its unique ability to mine potential evidence. . The newly launched EnCase7 has more powerful acquisition capabilities, adds support for tablets and smartphones with multiple operating systems; it can directly encrypt new evidence file formats (Ex01 and LEFx) to ensure evidence security; the evidence processor is more automated , Folder recovery, file signature parsing, keyword search, indexing and other common tasks are automated. EnScript processor newly integrated system information analysis module, instant communication analysis module, file recovery module, personal information extraction module (CC, Phone Numbers, Email, SSN), Windows event log analysis module, Windows operation record analysis module, Unix login information Parsing module, Linux system log parsing module, also added custom EnScript function. In terms of in-depth forensics analysis, analysis of file systems and file types of EXT4, HSFX, MicrosoftOffice2010, Checkpoint / Pointsec encrypted files, iOS physical images (iPad, iPhone, iPod) are newly added. The new email survey platform can view the email mutual records And related information. Custom reports in EnCase7 customize reports to ensure report quality and consistency, and provide case archiving capabilities. In addition, the new version also adds FastblocSE software write protection function, which can write protection for USB, Firewire, IDE, SATA and SCSI storage. The Encase Physical Disk Emulator (PDE) function can perform in-depth analysis through the VMWare virtual machine and some other third-party tools after loading computer evidence to a local disk.

FTK (ForensicToolkit) of American AccessData Company provides a powerful search function and is recognized as the world's preferred software for file and email analysis. FTK's built-in OutsideInViewer technology can view more than 270 different formats of files. Customizable filtering options can meet the needs of users to quickly find the evidence needed from tens of thousands of files. The full-text indexing function can instantly generate search results with super powerful images. And Internet information search capabilities. Email and compressed file analysis is one of the features of FTK. It can automatically release data from compressed files in PKZIP, WinZp, iWinRAR, GZIP, and TAR formats. It supports MsOutlook, OutlookExpress, AOL, Netscape, Yahoo, Earthlink, Eudora, Hotmail, MSN. , E-mail, you can view, search, print, export e-mail messages and attachments, you can restore and delete some mail information.

X-waysForensics from Germany X-ways is an excellent computer forensics tool. It is closely integrated with WinHex software, making it have powerful data recovery functions and data analysis functions. For example, it can recover specific file types. View and fully obtain RAM. And running processes in virtual memory; can collect residual space, free space, and partition gap information from disks or image files; can easily discover and analyze ADS data (NTF Salternate datastreams), which is sometimes also EnCase and ILook Undetectable, and added many unique features, such as powerful physical search and logical search function, can search multiple keywords at the same time.

FBIForensicDesktop of Australia's Nuix Corporation has been rated as the world's leading graphical analysis tool for email and electronic data. After version 3, it no longer analyzes only email, and has become a professional mass electronic data analysis tool. Through analysis server / multi-workstation Work together to quickly sort and preview various data. NuixForensicDesktop reads the original file format directly when processing data. The types of mail formats supported cover common mail types. Its simple but very powerful graphical display function can clearly describe how events occur and how evidence enters. Internal What happened and who was involved in the incident, revealing the relationships between correspondents.

Digital Detective's NetAnalysis has become the industry standard for Internet history analysis and restoration. NetAnalsis software can find records directly from write-protected physical and logical disks. It can find and restore historical records from unallocated space, Swap swap files, FileSlack, file remnants, unused disk space, DD images and binary files. Automatically find the original picture on the page, and automatically rebuild the HTML page. The recovered page is exactly the same as the one seen by the suspect. NetAnalysis automatically filters and categorizes search terms, which makes it possible to submit them separately as evidence. In addition, NetAnalysis also supports keyword databases and SQL queries, which can be shared with other investigators or reserved for other analyses. The offline cache data viewer DigitalDetectiveHstEx can also work together as other analysis software (such as Encase, X-Ways Forensics). It is a small, fast, plug-in viewer that supports Flash, images, and office documents, PDFs.