Performance Comparison of Forensic Software for Carving Files using NIST Method

Abstract

Data lost due to the fast format or system crash will remain in the media sector of storage. Digital forensics needs proof and techniques for retrieving data lost in storage. This research studied the performance comparison of open-source forensic software for data retrieval, namely Scalpel, Foremost, and Autopsy, using the National Institute of Standards Technology (NIST) forensic method. The testing process was carried out using the file carving technique. The carving file results are analyzed based on the success rate (accuracy) of the forensic tools used in returning the data. Scalpel performed the highest accuracy for file carving of 100% success rate for 20 document files in pdf and Docx format, and 90% for 10 image files in png and jpeg format.

Keywords

• digital forensics
• data retrieval tools
• file carving
• accuracy of forensic tools