00000nam 2200000za 4500 9.821336 CaOODSP 20240219183447 cr ||||||||||| 160719s2013 onc|||||o f000 0 eng d CaOODSP eng eng fre n-cn--- D68-6/161-2009E-PDF Carbone, Richard. File recovery and data extraction using automated data recovery tools [electronic resource] : a balanced approach using Windows and Linux when working with an unknown disk image and filesystem / by Richard Carbone. [Ottawa] : Defence Research and Development Canada, c2013. x, 52 p. : tables, graphs. Technical Memorandum ; 2009-161 "January 2013." Includes bibliographical references. This memorandum is the direct result of the analysis of an unknown disk containing unknown data, files and filesystem. The disk was brought to an analysis team at DRDC Valcartier by an agency that desired to ascertain the research centre’s capabilities for extracting and recovering unknown forensic data from an unknown disk and, if possible, automate the process. However, a thorough analysis using various Windows and Linux-based automated data and file recovery tools has led the author to determine that automated tools, regardless of the underlying system, are not yet up to this specific challenge. In addition, the author is of the opinion that fully automated disk recovery tools will never be entirely successful. Instead, the author has determined that a manual approach to data and file extraction will be necessary in order to recover any meaningful data or files from this disk’s unknown filesystem. However, this memorandum will only examine the automated approach used by the various Windows and Linux tools. An additional follow-up study will specifically examine the required manual approach necessary for data recovery from an unknown disk using data pattern matching techniques and sector-by-sector analysis using known file signatures. gccst Technical reports Computer forensics Data extraction Data recovery Defence R&D Canada. Technical memorandum (Defence R&D Canada) 2009-161 (CaOODSP)9.820564 PDF 9.54 MB https://publications.gc.ca/collections/collection_2016/rddc-drdc/D68-6-161-2009-eng.pdf