Duplicate the Data & Recover Data Lost this article explain in investigation evidence how should be duplicate data should be recover and which software are use for recovery data.
Duplicate the Data (Imaging)
Performing the investigation on the original evidence can misdirect the investigation to different results and could make the original evidence vulnerable. Data duplication is an important step in securing the original evidence. Investigating the original evidence can cause damage to the identity of the evidence that would make it no longer useful to the case.
Data duplication includes bit-by-bit copying of the original data using a software or hardware tool. The duplicated data should be an exact blueprint of the original evidence, and make two or more copies to perform different investigations. The copies can also help if one copy is damaged. Send the duplicated data to the forensics lab for investigation and further analysis.
Verify Image Integrity
Hash values are equivalent to data fingerprints. No two files contain the same hash values. The hash algorithms used in forensics are MD5 and SHA. Calculate and match the MD5 hash for the original evidence and the forensic image. The same hash values show that the image is the same as the evidence.
Related Product : Computer Hacking Forensic Investigator
Tools for calculating hash value are:
- HashCalc: HashCalc is a calculator that allows computing message digest checksums and HMACS for files, as well as for text and hex strings.
- MD5 Calculator: The MD5 Calculator is a program that will enable you to calculate the MD5 value of the selected file.
- HashMyFiles: HashMyFiles is a small utility that allows you to calculate the MD5 and SHA1 hashes of one or more files in your system.
- MD5 Hash Calculators: Hash Calc, MD5 Calculator and HashMyFiles
HashCalc
source: http://www.slavasoft.com
HashCalc allows computing message digest checksums and FIMACs for files, as well as for text and hex strings. It offers a choice of 13 hash and checksum algorithms for calculations.
Features:
- Support for 12 well-known and documented hash and checksum algorithms: MD2,. MD4, MD5, SHA-1, SHA-2 (256, 384, 512). RIPEMD-160, PANAMA, TIGER, ADLER32, and CRC32
- Support for a custom hash algorithm (N1D4-based) used in eDonkey and eMule applications
- Support for 2 modes of calculations: HAS4/0-1ECKSUM and HMAC
- Support for 3 input data formats: files, text strings, and hex strings
- Works with large size files (tested on file sizes up to 15 GB)
- Drag-and-drop support
- Quick and easy installation
- Calculates hash/checksum and HMAC for files of any type: music, audio, sound, video, image, icon, text, compression, etc., with the extensions: .mp3, ,wav, .avi, .mpg, .midi, mov, ,dvd, .ram, .zip, .rar, .ico, .gif, .pif, .pic, ,tif, .tiff, .txt, .doc, ,pdf, ,wps, .dat, All, ilex,
- bin, .cpp, Ass, .par, .pps, .cue, .ram, .md5, .sfv, etc,
MD5 Calculator
Source: http://www.bullzip.com
The MD5 Calculator is a program that will enable you to right-click any file and select “MD5 Calculator” from the context menu. This will calculate the MD5 value of the selected file. You can compare the calculated value to a value given to you by another person or from a website.
HashMyFiles
source: http://www.nirsoft.net
HashMyFiles is a small utility that allows you to calculate the MD5 and SHA1 hashes of one or
more files in your system. HashMyFiles can also be launched from the context menu of Windows Explorer and display the MD5/ SHA1. hashes of the selected file or folder. HashMyFiles does not require any installation process or additional DLL files.
Also Read : Understand the Chain of Custody and It’s Importance
Recover Lost or Deleted Data
Modern operating systems make it difficult to delete a file completely from a system. When a file is deleted unintentionally, stop using the system. Collect the lost or deleted data for evidence on the internal and external devices.
Software used to recover the data
Examples of software used to recover lost or deleted data;
1. Recover My Files
Source: http://www.recovermyfiles.com
Recover My Files data recovery software will recover deleted files emptied from the Windows Recycle Bin, or lost because of the format or corruption of a hard drive, virus or Trojan infection, and unexpected system shutdown or software failure.
2. Recuva
Source: https://www.piriform.com
Recuva can recover pictures, music, documents, videos, emails or any other file type that are lost. It can recover from any rewriteable media like memory cards, external hard drives, USB sticks etc.
3. EASEUS Data Recovery Wizard
Source: http://www.easeus.com
It is hard drive data recovery software to recover data lost from PCs, laptops, or other storage media because of deleting, formatting, partition loss, OS crash, virus attack etc.
4. Advanced Disk Recovery
source: http://www.systweak.com
Advanced Disk Recovery scans the entire system for deleted files and folders and provides an opportunity to recover them. Hard drives, partitions, external devices, and even CDs and DVDs can be scanned for recoverable flies using Advanced Disk Recovery. The software offers two types of scans. The Quick Scan uses the Master File Table to find all files with the same filename. The Deep Scan uses file signatures to search for deleted files or folders. After either type of scan, one can preview the deleted files and folders, and restore any or all of them to the location of choice. With just a few clicks, one can locate and restore most of the deleted files.
5. Ontrack EasyRecovery
Source: https://www.krollontrack.com
Ontrack EasyRecovery is a data recovery software ready to retrieve missing files. It recovers data and also protects it.
Questions related to this topic
- How do I find the hash value of a file?
- Where is sha256 hash of a file?
- How do I view hash files in Windows 10?
- What is the hash of a file?
This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092
Contact us – www.info-savvy.com
