The Analysis of File Carving Process Using Photorec and Foremost
Total Page:16
File Type:pdf, Size:1020Kb
The Analysis of File Carving Process Using Photorec and Foremost Nurhayati, Nurul Fikri Department of Informatics Engineering, Faculty of Science and Technology Syarif Hidayatullah State Islamic University Jakarta Jl.Ir.H.Juanda No.95 Ciputat 15412 Jakarta-Indonesia [email protected], [email protected] Abstract— Rapid development of computer is followed by multiplatform, making it is easy to run and does not require development of digital storage device. One common problem of configuration. PhotoRec possesses carving by examining digital storage device is data loss. The problem of data loss could every existing blocks on the storage media. Meanwhile, be solved by using file carving techniques, for example. File Foremost based on Linux, can only be used on Linux and carving techniques could be performed using carving tools, such requires a configuration in the process of carving. Foremost do as PhotoRec and Foremost. This research was conducted to know the carving process by finding a header and footer files. and to compare performance of carving process from PhotoRec PhotoRec and Foremost will be used in research to restore and Foremost based on three parameters, which are the number files with various types: jpg, png, bmp, and tif, and of return files, file validation, and the rate of process. The multimedia files such as audio and video such as wav, mp3, research used simulation methods. The process of file validation wma, mp4, mkv, avi and flv. uses hash algorithm SHA1 to make sure the similarity between original and return files. The result of this research shown with Based on the explanation above, research titled "Analysis table that PhotoRec has a higher performance than Foremost. of File Carving Process Using PhotoRec and Foremost" has PhotoRec have return files less than Foremost, but PhotoRec has been done and expected to be a reference for further a higher percentage of valid files than Foremost. Additionally, development of carving tools. In addition, this research is also the rate of carving file process done by PhotoRec is higher than expected to be a reference to choose a carving tool and to give Foremost. Finally, the research reaches the conclusion that knowledge to people about the technique of returning data PhotoRec is better than Foremost. loss. Keywords— File carving, PhotoRec, Foremost, SHA1, Hash Algorithm, disk image II. RELATED WORK Data loss [7] can occur due to various causes, among I. INTRODUCTION which is a virus, human error, hardware malfunction or a Technological development is followed by the system error. Data loss can occur in a variety of files, like development of digital storage media. Digital storage media documents, photos, and email. Based on a survey by statistic cannot be spared from a problem such as data loss [7]. The (2015), digital data that is missing mostly are data in the form data loss occurs due to many factors, which are the virus, of videos and photos [9, 16]. hardware malfunction, software malfunctions and corrupt. To Data loss can be overcome by using one of the methods in overcome this, a method to restore data which is called file computer forensics which is called file carving [8,13]. Carving carving used [3, 14]. file is an important aspect of computer forensics and has a There are various carving tools which have their respective major impact on computer forensics because it adds the advantages, among which are PhotoRec, Foremost, Scalpel, flexibility to retrieve stored information from the underlying EnCase, FTK, and Adroit Photo Forensics [4]. Regardless of file system [12]. There are several carving tools that can be the level of sophistication, the performance of each carving used for computer forensics. The simplest carving tool works tools are different. This was caused by differences in methods by finding the header and footer. A more sophisticated carving and configurations used by the carving tools itself. There are tool performs validation before the file is stored into disk, three parameters that are commonly used by forensic called validating file carvers. Meanwhile, the most advanced practitioners in assessing the performance of a carving tool: carving tool can collect back fragmented files called the percentage of the return file, correctness and reliability of fragmented file recovery [5]. the results provided by the tool, as well as the speed in the Byeongyeong do research return of multimedia files that carving process [1, 10]. are in a compressed state but only 3 types of multimedia files This research used PhotoRec and Foremost as carving tool used are AVI, WAV, and MP3 [17]. Meanwhile, Al Jumah in the process of file carving. PhotoRec has been selected for watched the results of carving coming from disk image and an application that can be run in different OS or called disk drive. The study was conducted to determine whether there are differences in carving results between disk image and disk drive [6, 15, 2]. Imagin Carvin The method of carving file can restore data loss. However, g g reference [10, 14] stated that new problems arise with no Proces Proces many carving tools available, such as not knowing the s s capabilities and limits on the carving tools so it is not effective (Fore to restore the data. Based on the explanation above, this study performed most) analysis file carving using PhotoRec and Foremost. The study aims to determine the performance of the process of carving. The criteria to be used in the form of speed file analysis carving carving process, the number of returned files and validation of returned files. III. PROPOSED SOLUTION This study uses a simulation, the simulation method consists of several stages as follows: Fig 2. Process of carving through the disk drive A. Conceptual Model There are two concepts in this research: the process of The components in each architecture is as follows: carving through the disk drives directly and the process of 1. Storage Device carving through the disk image [11]. Storage device or storage medium is used as input. The author uses a storage medium a Toshiba 16GB flash drive in this study. The flash provides a wide range of image files and multimedia, such as video and audio. This study is conditioning the flash in a state of formatted files contained has not been affected or overwritten by other files, so returning data using carving technique could be performed. 2. Imaging Imaging is used to create clones of the storage media in the form of an image. Making the image will be performed using dc3dd. The formation of this imaging will generate a file ends in .img, .dd, or.raw. The author uses imaging to the process of carving using PhotoRec and Foremost. 3. Carving Tools Carving tool is a tool used to restore data. This study used two carving tool, PhotoRec and Foremost. Each carving tools have different configurations. Using one same tool, can also be obtained different results because of the differences in the Fig 1. The proces of carving through the disk image configuration used. Therefore, the present study analyzes the performance of the process of carving using several parameters, namely speed carving process, the number of files that are returned and the validity of the return files. 4. Output/ Carving Result Once the carving process has finished, there would be found a folder containing the files from the original ones. The folder has been initially inaccessible and afterwards it is obtainable. They caused the folder to change the order. Finally, the folder can be read, written and executed. 5. Validation Finally, the results of carving, validation is performed to check is the file correct. It means the file is same from original. The checking is done by comparing the original file with the accordance with the provisions of the conceptual model, the previous file. The author uses a simple shell script SHA1 hash output of input data and modelling. function algorithm for comparing a hash value of the original file with the return file. Based on the validation results F. Experimentation obtained, can be determined whether the file is correct or not by comparing a hash value between the previous file with the After PhotoRec and Foremost installed on Ubuntu, then file carving. the process will be conducted in accordance with the file returns simulation concepts and models that have been described previously. After the carving process is completed B. Input / Output Data and then will do the validation process using the shell script Based on the results obtained at the time of formulating the file that was created. Validation is done by comparing the hash problem, it can be found that one of the most frequently value of the original file with the file back. missing files are photos and video. Therefore, the present study determines some photos and video files that have a G. Output Analysis format is different, such as the three pieces of the file type bmp, jpg, mkv, mp3, png, tif, avi, flv, mp4, wav, wma. Analysis of the results obtained after completion of Overall, the total number of files to be restored is 33 files. running all the scenarios that will be discussed in the next chapter. C. Modelling Making the scenarios that will be used for the simulation process. In this study, there are eight scenarios, each of the IV. ANALYSIS AND SIMULATION RESULT four scenarios process of carving through the disk image and the fourth scenario carving process through direct disk drive. A. Simulation 1 Each scenario will be put through the process of carving using Experiments conducted in each scenario aims to get the PhotoRec and Foremost and will be conducted in three average value of each scenario designed.