• DFIR Resources
  • Comparison of data recovery techniques on master file table between Aho-Corasick and logical data recovery based on efficiency

Comparison of data recovery techniques on master file table between Aho-Corasick and logical data recovery based on efficiency

Hot
77 1

DFIR Resources

Research and Documentation
White Papers & Journals
Analysis - Devices & OSs
  • Data Carving and File Recovery
  • MFT
Data recovery is one of the tools used to obtain digital forensics from various storage media that rely entirely on the file system used to organize files in these media. In this paper, two of the latest techniques of file recovery from file system (new technology file system (NTFS)) logical data recovery, Aho-Corasick data recovery were studied, examined and a practical comparison was made between these two techniques according to the speed and accuracy factors using three global datasets. It was noted that all previous studies in this field completely ignored the time criterion despite the importance of this standard. On the other hand, algorithms developed with other algorithms were not compared. The proposed comparison of this paper aims to detect the weaknesses and strength of both algorithms to develop a new algorithm that is more accurate and faster than both algorithms. The paper concluded that the logical algorithm was superior to the Aho-Corasick algorithm according to the speed criterion,   whereas the algorithms gave the same results according to the accuracy criterion. The paper leads to a set of suggestions for  future research aimed at achieving a highly efficient and high-speed data recovery algorithm such as the file-carving algorithm.

Attachments

  • File Description
    File Size
    File Type
    Downloads
  • Comparison_of_data_recovery_techniques_o
    638 KB
    2

User comments

There are no user comments for this listing.
Already have an account? or Create an account