A Tool for Recovery of Deleted Contiguous Files from Storage Media : Limitations and Guidelines for Solutions - K. Srinivas; K. Saicharan (International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 2025)
Digital forensic labs across the globe looking for next generation software tool for extracting evidence from suspected storage media. The current tools cannot extract the existing evidence when the deleted files are fragmented. Also, they cannot extract evidence from partially existing set of blocks of deleted files. In the past two decades enormous research across the globe has taken place to address these challenging problems. Now it is time to focus on concentrating on translational research to build a next generation evidence extraction tool for use in digital forensic labs. In this paper, we propose an initial version of the next generation evidence extraction tool named as “ByteSequenceToEvidence 1.0”. This paper contributes (a) Recovery of deleted contiguous files (b) Limitations of the current version and guidelines for incorporating the available research outcomes in future versions. In this paper, we also present the fundamentals of file carving that researchers developing evidence extraction tools should understand.