Research And Implementation Of Computer Forensics Technology Based On Data Recovery From Flash Memory

With the rapid development of computer technology, Hi-tech crime become more and more serious.Criminals will find ways to cover up evidence of a crime.So it is the important subject for computer forensics to research how to acquire and analyze sensitive information from memories. On the other hand, with the advances in technology, flash memory devices (such as U disk) has become an important carrier for the majority of computer users to store and backup data. At the same time in the consumer electronics (such as mobile phones, digital cameras, etc.) and other embedded devices, Flash memory has also been increasingly widely used.Therefore, data recovery technology for flash memory devices became more important in computer forensics.This paper discusses computer forensics technology based on U disk logical data recovery and data recovery of FAT32 file system. In the U disk logical data recovery process, by analyzing the FAT file system storage features this thesis designed corresponding experimental data based on logic sector number, analyzed the flash memory physical data to find out the mapping from physical address to logical address then implement the U-disk logical data recovery, and on this basis to design a dynamic scanning method.In the data recovery of FAT32 file system, this paper presents the method of using Linux system tools to recovery normal files as well as directories and to search for evidence.For the loss files caused by man-made deleted or formatted, after research on principles of file deletion and formatting on FAT32 file system,this paper designed and implemented the appropriate procedures for data recovery, which can do fast and deep scan on file system, maximize the discovery of deleted data and remnant data after formatting, and restore deleted data most.