Search

This paper proposes protocol of information recovery in solid hard disks - SSD by means of the use of File Carving techniques, analyzing factors of incidence, scenarios of affectation, type of file to recover, as well as the fragmentation of the same. In this regard, it hopes to be a support in the work of computer expertise or auditing in the field of information retrieval in SSD.

This document proposes to analyze the contribution of File Carving techniques in the recovery of data in solid state devices (Solid State Drive — SSD) that have been affected by crush and fall scenarios with different strengths. For this purpose, Semantic Carving and Fragment Recovery Carving techniques have been used. Obtaining results categorized in the metrics: number of files recovered, number of valid files recovered, number of partially recovered files, number of false positives. Finally, the results obtained are compared by applying the mathematical model of linear regression.

This document proposes to make a contribution to the conceptualization and implementation of data recovery techniques through the abstraction of recovery methodologies and aspects that influence the process, relating human motivation to research needs, whether these are for the Auditing or computer science, allowing to generate classification of recovery techniques in the absence of the metadata provided by the filesystem, in this sense have been proposed to file carving techniques as a solution option. Finally, it is revealed that while many file carving techniques are being implemented in other tools, they are still in the research phase.