|
000
| 02474nam 2200313za 4500 |
|---|
| 001 | 9.821336 |
|---|
| 003 | CaOODSP |
|---|
| 005 | 20240219183447 |
|---|
| 007 | cr ||||||||||| |
|---|
| 008 | 160719s2013 onc|||||o f000 0 eng d |
|---|
| 040 | |aCaOODSP|beng |
|---|
| 041 | |aeng|bfre |
|---|
| 043 | |an-cn--- |
|---|
| 086 | 1 |aD68-6/161-2009E-PDF |
|---|
| 100 | 1 |aCarbone, Richard. |
|---|
| 245 | 10|aFile recovery and data extraction using automated data recovery tools |h[electronic resource] : |ba balanced approach using Windows and Linux when working with an unknown disk image and filesystem / |cby Richard Carbone. |
|---|
| 260 | |a[Ottawa] : |bDefence Research and Development Canada, |cc2013. |
|---|
| 300 | |ax, 52 p. : |btables, graphs. |
|---|
| 490 | 1 |aTechnical Memorandum ; |v2009-161 |
|---|
| 500 | |a"January 2013." |
|---|
| 504 | |aIncludes bibliographical references. |
|---|
| 520 | |aThis memorandum is the direct result of the analysis of an unknown disk containing unknown data, files and filesystem. The disk was brought to an analysis team at DRDC Valcartier by an agency that desired to ascertain the research centre’s capabilities for extracting and recovering unknown forensic data from an unknown disk and, if possible, automate the process. However, a thorough analysis using various Windows and Linux-based automated data and file recovery tools has led the author to determine that automated tools, regardless of the underlying system, are not yet up to this specific challenge. In addition, the author is of the opinion that fully automated disk recovery tools will never be entirely successful. Instead, the author has determined that a manual approach to data and file extraction will be necessary in order to recover any meaningful data or files from this disk’s unknown filesystem. However, this memorandum will only examine the automated approach used by the various Windows and Linux tools. An additional follow-up study will specifically examine the required manual approach necessary for data recovery from an unknown disk using data pattern matching techniques and sector-by-sector analysis using known file signatures. |
|---|
| 692 | 07|2gccst|aTechnical reports |
|---|
| 693 | 07|aComputer forensics |
|---|
| 693 | 07|aData extraction |
|---|
| 693 | 07|aData recovery |
|---|
| 710 | 2 |aDefence R&D Canada. |
|---|
| 830 | #0|aTechnical memorandum (Defence R&D Canada)|v2009-161|w(CaOODSP)9.820564 |
|---|
| 856 | 40|qPDF|s9.54 MB|uhttps://publications.gc.ca/collections/collection_2016/rddc-drdc/D68-6-161-2009-eng.pdf |
|---|