Proceedings of the Third International Conference on Computer Science, Computer Engineering, and Social Media (CSCESM2016), Thessaloniki, Greece, 2016 Evaluation of Digital Forensics Tools on Data Recovery and Analysis Ioannis Lazaridis, Theodoros Arampatzis, Sotirios Pouros AMC Metropolitan College 14th El. Venizelou Str., 54624, Thessaloniki, Greece
[email protected] ABSTRACT Image/Video/Audio Files System/Server/Network Log Files This paper presents a comparison and evaluation of Emails several digital forensics tools on data recovery Browser History/Cache scenarios. Modern tools have been tested and evaluated in order to provide evidence regarding Document Files such as their capabilities in qualitative analysis and .doc/.txt/.xml/.pdf recovery of deleted data from various file systems. Results derived from the comparisons, present the Hard drives are likely to include an Operating capability of each digital forensics tool. Based on System (or more than one), application variables and specifications, the tool with the best programs and user data stored in files. Hard performance is considered the most suitable drives also provide additional storage for application for analysing and retrieving files. A system information used by the processor if comparison between digital forensics tools takes necessary (backing store) [9-15]. place as well, alongside conclusions. The hierarchy of files is divided in six levels: KEYWORDS Level 0 (Regular Files): The Forensic analysis, Data Recovery, Encase, Autopsy, FTK imager, DFF, OSForensics, Recuva information contained in the file system. It includes the file names, file attributes and file content. Can be accessed 1 INTRODUCTION directly. Level 1 (Temporary Files): Temporary Digital forensics is the science which deals with files, including printed files (print the discovery, validation and interpretation of spooler), the cache of the browser and digital evidence found in electronic devices, files in the Recycle Bin.