Case study of file carving in unallocated space

Abstract

In computer forensic analysis is necessary to look for evidences in all partitions of the analyzed disk. However, many times the evidences were previously deleted in an attempt to hide proofs or because a long time have passed and the user did not need that file and then deleted it. Therefore, this article demonstrates how is done the analysis of deleted files, how deleted files are discovered in the unallocated area of ​​the non-volatile memories (HDD, SSD, etc.) of the hard disk driver analyzed. In order to carry out such analysis, a brief review of hash algorithms was made, for files with previously known hash values, as well as an analysis of the file headers by viewing the files in hex so that it was possible to determine the file extension, its original and its directory of origin. In order to make the practice accessible to all users, free forensic softwares were used such as Guymager, for forensics acquisition propose, and Autopsy, in order to analyze the recovered data. Although, there are free and commercial programs for forensic analysis, the interpretation of the data is necessary and it has proved to be capable of recovering and identifying files that had been erased from memory even if they had been partially overwritten.