Pity the digital forensic investigator: the quantity of data stored on PCs continues to increase at a mind-boggling pace, with the gigabytes of files, images and videos growing every month. As a result, investigations — into everything from intellectual property theft and fraud to child pornography and espionage — can become lengthy undertakings.
New “SmartCarving” techniques, however, are helping speed up the process and retrieve more data than previous methods. For example, SmartCarving can reconstruct approximately 99 percent of digital images stored on a hard drive or media card. That’s an improvement over the next-best technique, called file-carving, which retrieves about 85-90% of non-overwritten images.
The forensic issue has long been fragmentation. According to a study of 350 hard drives conducted by security researcher Simson Garfinkel, 6% of data on the average hard drive is fragmented, meaning it’s intact but stored non-contiguously. Furthermore, for files with forensic importance, actual fragmentation rates were much higher: 58% for PST (Outlook) files, 17% for Word documents, and 16% for JPEGs.
via SmartCarving Technique Aces Data Recovery — Security — InformationWeek.
