RETRIVAL OF MOBILE DATA WITHOUT USING THE STORAGE META-DATA

Abstract

Normally recovery software is using file system information to recover the data which have been deleted. File system information are file tables, meta-data etc., So, when a disk is formatted then all the information and the metadata will also be lost. At this scenario, normal recovery techniques are not useless. For this comes, File carving, which is the process of recovering files from a disk without the help of a file system information. Even without the knowledge of the memory structure, we can carve out the data from a formatted disk. In forensic, this is a very helpful technique in searching the hidden and recently formatted disk contents. We already have many tools available for file carving, like foremost, scalpel etc., File carving is most often used to recover files from the unallocated space in a drive. Unallocated space refers to the area of the drive which is no longer holding any file information as indicated by the file system structures like the file table. In the case of damaged or missing file system structures; this may involve the whole drive. While deleting a file from the disk, the will not be deleted directly from the physical memory, the logical memory containing the information regarding the starting address of the file is deleted or made to zero. Thus the original data in the physical memory will be available, unless it is overwritten by another file. So we use this technique to find the lost data in mobile devices. Mobile devices are becoming very important mode of communication and becoming evidence for a variety of crimes. The information like SMS, MMS, images and other data from the mobile phone are very important to identify the criminals. So carving the data from the mobile devices will be terribly useful for the upcoming years.