This Small Business Technology Transfer (STTR) Phase II research project proposes to research and bring to market the next generation digital data recovery techniques. The problem of restoring lost data from a damaged digital device arises routinely in digital forensics and data recovery. In many advanced cases of digital storage failure currently available file recovery techniques based on disk storage information fail. During the Phase I of this project a software framework was developed for file carving. Using this framework a software library and a user interface to carve fragmented files from a disk image, called Adroit was implemented. Adroit currently supports carving of JPEG fles, structured documents (such as HTML, source code, plain-text fles, etc.), and Microsoft office documents. In tests conducted, Adroit recovers more files than tools currently available in the market. Furthermore, the validation and user interface component built into Adroit excels at allowing the user to guide the technology to recover more data with much less effort. The problem of recovery of information from bits and pieces of digital data, in the absence of storage meta-information to tie the pieces together, is equivalent to the problem of having hundreds/thousands of jigsaw puzzles mixed into together. The challenge of identifying if a piece of data belongs to a specific file or file type is daunting. The preliminary research conducted in Phase I has demonstrated the viability of developing domain specific techniques to identify the type of data fragments and the use of file type specific algorithms to reconstruct files.
The broad impact of this technology and its commercialization are: 1) it will change the nature of the data recovery market and make possible unprecedented recovery of data in a variety of situations; 2) it will save countless users the agony of losing valuable data. Be it important data that is needed for a company's survival or an emotionally valuable photograph of a proud parent or child; 3) it will provide law enforcement officials with an increased ability to gather evidence and prosecute their cases more effectively; 4) it will provide counter-terrorism experts the ability to glean crucial evidence that they may have otherwise missed.
