Short on time?

Get essay writing help

General Overview Of Forensic Data Recovery

Words: 627
Page: 1
This essay sample was donated by a student to help the academic community. Papers provided by EduBirdie writers usually outdo students' samples.

Forensic data recovery is the science and art of retrieving or getting back information from a mobile device, computer, and any other electronic media that was damaged, lost, deleted, or hidden (Casey, 2011). Forensic data recovery is different from other processes of data recovery in terms of the method used, but the results are the same. With forensic data recovery, objectives are laid out from the word go since it is not well examined and adequately dealt with claims can be compromised. Forensic data recovery is unique as it deals with legal matters and therefore needed in court. It is done by specialists who acquire, isolate, and report on electronic evidence and digital media (Breeuwsma et al., 2007).

One of the techniques utilized by forensic data recovery is file carving, which excerpts data from a storage device with no need for the file system that created the file initially. It recovers files and data in an unallocated space with no file information in data recovery (Richard, Roussev, & Marziale, 2007). Unallocated space is the area in the drive, then no longer has any file information. It is most useful when data or file is damaged or goes missing. Most file systems do not entirely remove data when it is deleted; instead, it removes the knowledge of where it is placed. This mechanism reconstructs files by scanning the raw disk bytes and brings them together (Povar & Bhadran, 2010). This involves only a few first and last bytes. Most legal cases that depend on this mechanism are child pornography, where experts recover more images from users’ hard disks.

Save your time!
We can take care of your essay
  • Proper editing and formatting
  • Free revision, title page, and bibliography
  • Flexible prices and money-back guarantee
Place Order

File recovery is different from file carving. Operating systems currently in the market do not remove a deleted file without requesting confirmation by the user. Deleted files are recovered using forensic programs if the erased file space is not overwritten by another archive. Any file that is damaged is only recoverable if data is not corrupted more than a minimal degree (Cohen, 2007). File recovery and file restoration are different since a backup file stored in an encoded form is restored to its decoded form. File recovery mechanisms use file system information and using this information, many of the deleted or damaged files can be recovered. Whenever information is incorrect, then it cannot work.

File carvings can only work on raw data on the media, and it is not linked with the file system structure. File carving is not concerned with any file systems that are used for storing files. For example, the FAT file system is a file that is deleted then the file directory entry is moved to unallocated space (Povar & Bhadran, 2010). The filename’s first character is substituted with a marker, but the file data itself is left unmoved. The information is present until it is overwritten. All this recovery is possible since file system stores retrieve, and updates files. File carving however has two issues. One is that without a file system the original name of the file cannot be discovered and second when a file is stored in a contiguous chunk which is appropriate for large files this technique is not able to recover the complete file,


  1. Breeuwsma, M., De Jongh, M., Klaver, C., Van Der Knijff, R., & Roeloffs, M. (2007). Forensic data recovery from flash memory. Small Scale Digital Device Forensics Journal, 1(1), 1-17.
  2. Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the internet. Academic Press.
  3. Cohen, M. I. (2007). Advanced carving techniques. Digital Investigation, 4(3-4), 119-128.
  4. Povar, D., & Bhadran, V. K. (2010, October). Forensic data carving. International Conference on Digital Forensics and Cyber Crime (pp. 137-148). Springer, Berlin, Heidelberg.
  5. Richard, G., Roussev, V., & Marziale, L. (2007, January). In-place file carving. In IFIP International Conference on Digital Forensics (pp. 217-230). Springer, New York, NY.

Make sure you submit a unique essay

Our writers will provide you with an essay sample written from scratch: any topic, any deadline, any instructions.

Cite this Page

General Overview Of Forensic Data Recovery. (2022, March 18). Edubirdie. Retrieved September 24, 2023, from
“General Overview Of Forensic Data Recovery.” Edubirdie, 18 Mar. 2022,
General Overview Of Forensic Data Recovery. [online]. Available at: <> [Accessed 24 Sept. 2023].
General Overview Of Forensic Data Recovery [Internet]. Edubirdie. 2022 Mar 18 [cited 2023 Sept 24]. Available from:
Join 100k satisfied students
  • Get original paper written according to your instructions
  • Save time for what matters most
hire writer

Fair Use Policy

EduBirdie considers academic integrity to be the essential part of the learning process and does not support any violation of the academic standards. Should you have any questions regarding our Fair Use Policy or become aware of any violations, please do not hesitate to contact us via

Check it out!
search Stuck on your essay?

We are here 24/7 to write your paper in as fast as 3 hours.