The digital forensic process, anti-forensic techniques and the model was then tested in a Delphi-inspired study where questions regarding the digital forensic process and anti- forensic techniques was asked to digital forensic specialists as well as information security specialists. Using the digital forensic process as a base, this paper produces a model that classifies anti-forensic techniques into realms and shows which realm affects which stage of the digital forensics process. This paper sets out to clarify the digital forensic process, what tools are used within the digital forensic process and what anti-forensic techniques are available on the market. It is not known if this exploit is being used in the wild but the mere thought of security issues existing in tools is a serious issue for law enforcement. Roughly a year ago, a company announced that they can actively exploit security flaws in a popular digital forensics suite, thus raising questions of validity of evidence submitted to court.
The area of digital forensics might be old but the idea that criminals or other organisations are actively working to hide their steps is somewhat new. And the files that have been recovered will be fully recovered. It's just that this method cannot be used using the graphic user interface (GUI) but using the CLI (Command Line) in the LINUX operating system.
This study uses a tool comparison method approach using foremost recover and Testdisk recover. Unfortunately, tools such as FTK imager and TSK recover have a weakness, namely that some damaged or corrupted data files cannot be restored in their entirety they can only be recovered but not be opened. One of them is to use a complete data recovery method using forensic tools, namely, TSK Recover, FTK Imager, Foremost Recover, and Testdisk Recover.
If the data has been lost or deleted or even tampered with, then a forensic expert has several ways to restore data that has been lost or damaged. Data recovery is carried out if there is a condition where the data that has been owned is deleted or damaged. Data recovery is one of the forensic techniques used to recover data that has been lost or deleted.
0 kommentar(er)
