The Magic of Raw Data Carving
You have used all of the utilities in your expensive forensic suite, and other programs to carve files from unallocated file space. Do you think you have found everything? If you answered yes, guess again. The typical way that carving utilities are able to recover deleted data automatically is through file header and footer identification, and this recovers an intact file. In other words, a file has been deleted, but not yet overwritten by new data. What happens if part of the deleted file is now overwritten, but some of the old data still exists? What about file fragments from slack space? This informative and easy to follow lecture will show the attendees how they can manually carve data from unallocated file space, and also what to do with it so that it is useful. We will also be discussing data recognition. This means being able to not only see the search hit, but identify the context in which it is being seen. Drawing on case studies and real world examples from our lab, you can immediately apply these techniques once you return to yours.
