Digital Forensic Essay: Recovering Deleted Files And Hidden Text In Image.

What evidence id there of ownership of the laptop in particular is there evidence of more than one user?

Is there evidence that the laptop has been used to access data restrict by an access control devices within the leaning the crimes 1900 Section 308A?

Is there evidence of compromised personal financial data credit card on the computer?

Is there evidence that the laptop could not have been used as suggested?

We will investigate the probable intellectual property which is stolen by the Bob Apsen who is working as a contract employee of the Exotic Mountain Tour Services. The EMTS Company has completed a very expensive marketing process and analysis on customer service provided by the Superior Bicycle, LLC Company. The plan of the EMTS Company is to do an efficient advertisement for a joint product deal of Superior bicycles with their tour services. EMTS is under a nondisclosure concurrence with Superior Bicycles and must ensure this promoting effort material. An EMTS chief found a USB drive on the work area Bob Aspen was allocated to. This work is to decide if the drive contains exclusive EMTS or Superior Bicycles information. The EMTS chief additionally gives you some intriguing data he accumulated from the Web server executive. EMTS channels all Web-based email activity going through its system and distinguishes suspicious connections. At the point when a Web-based email with connections is gotten, the Web channel is activated.

This project aims to prepare a digital forensic report the given scenario. So we will recover the deleted file which has suspicious data that relevant to the case files from USB. The appropriate digital forensics tools were used to accomplish recover process. In our case study, we are going to use Winhex to recover the deleted image in the USB. The Stenography tool will be used for recovering the hidden text in Image. Then using the Pro Discover, we will recover the files from USB. So these recovery techniques need to be analysed before we proceed to findings.

The tools used in this case study are given below.

1. Winhex
2. Stenography
3. Pro Discover

In our case study, we are going to use Winhex to recover the deleted image in the USB. The Stenography tool is used for recovering the hidden text in Image. Then using the Remo recovery, we will recover the pdf file. So these recovery techniques need to be analysed before we proceed to findings.

WinHex is in its centre an all-inclusive hexadecimal supervisor, especially supportive in the domain of PC legal sciences, information recuperation, low-level information preparing, and IT security(AG, 2018). A propelled instrument for ordinary and crisis utilize: investigate and alter a wide range of documents, recuperate erased records or lost information from hard drives with degenerate document frameworks or from advanced camera cards. A propelled hex proof-reader, a device for information examination, altering, and recuperation, an information wiping device, and a criminology instrument utilized for prove gathering. Clients utilizing WinHex incorporate the Oak Ridge National Laboratory, Hewlett Packard, National Semiconductor, a few law requirement organizations, and numerous different organizations with information recuperation and assurance needs("WinHex: A powerful data recovery and forensics tool", 2018).

WinHex, which is good with Windows 95 through Windows XP, offers the capacity to:

• Read and specifically alter hard drives (FAT and NTFS), floppy plates, CD-ROMs, DVDs, Compact Flash cards, and other media.
• Recapture information.
• Encode records (128-piece quality).
• Wipe drives.
• Make hashes and checksums.
• Clone and picture drives.
• Hunt and supplant.
• Examine and look at records.
• Join and split records.
• Alter segment tables, boot parts, and other information structures utilizing layouts.
• Decipher 20 information composes.
• Read and specifically alter RAM.
• Assemble free and slack space.

Steganography is the craft of concealing a mystery message behind the typical message. This is utilized to exchange some mystery message to other individual and no between time individual will have the capacity to comprehend what the genuine message which we needed to pass on was. This specialty of concealing mystery messages has been utilized for a considerable length of time, all things considered, correspondences. Since the evolvement of computerized correspondence, it has additionally been utilized as a part of advanced discussions. In PC, it is accomplished by supplanting the unused or futile information of a standard PC document with the bit of our mystery message. This mystery shrouded data can be a plain instant message, figure content, or picture. One can conceal data in any sort of document. Normally picture, video and sound records are utilized to conceal plain instant message or picture message. Scarcely any instruments presently enable one to conceal documents inside a picture or sound record("Best Tools to Perform Steganography", 2018).

Forensics tools

The principle purpose behind utilizing steganography is that are concealing our mystery message behind a customary document. Nobody will presume the record. Individuals will for the most part figure it as a conventional record and our mystery message will abandon any doubt. The document used to shroud a message will work typically and we won't presume just by looking the record. There are different conditions when there is the need of secure transmission of records. Programmers are all around and dependably attempt to block correspondence to get private information.

By utilizing Steganography, we can diminish the possibility of information spillage. Regardless of whether the assailant gains admittance to our record or email, he will do not understand where the private document in our record is. There are different methods for accomplishing the steganography in advanced correspondence. In any case, we don't have to perform coding to accomplish this. There are different programming instruments are accessible for Steganography. This product can conceal the mystery message behind the picture document, HTML fil, DOC record or some other sort of record (Flandrin, 2018).

The Pro discover tool is very common useful tools for digital forensic. It is used to provide the effective data recovery process for an EMTS organization. It recovers the data from USB, hard drive and more. It is used to provide the cutting edge feature in the industry standards for proactive computer forensics because it is very powerful computer security tools. It easily enables the computer professionals to locate the data on a computer disk. It is used to handle all of your security concerns. It is helpful for capability, easy to user the GUI interface maker the process of pro discover forensic start - up is easy and simple. This tools is used to complete customizable depends on the cases to case.

To recover the deleted images in USB by use Winhex software. The Winhex is one of the popular recovery tools for windows. This tool is used to provide the effective recovery process for windows. It is also used to easily recovery the deleted data from the USB. The Winhex software also recovery the corrupted images from USB. It is shown below.

The above images show the corrupted images. This image will be recovered by using Winhex software. The corrupted image is shown below.

To recovery the corrupted images by open the Winhex software and clicks the tools to select the open disk. It is shown below

Here, we select the USB and click OK button. After, open the deleted images folder and it shows the deleted corrupt images. It is shown below.

After, click the tools to open the initialize the disk for shows the recovered file information and it is used to free up the disk space to save the recovered file.

After, recovery the deleted corrupted images by right click on the recovered file in Winhex window. Then choose the recovery and copy. It is shown below.

After, choose the output path to save the recovered file and it is shown below.

Finally, it shows the corrupted file and it also recovering the corrupt file is to normal file. It is shown below.

To recover the hidden text in image using the stenography tool and it used to provide the effective and efficient data recovery for windows. It is most commonly used software for data recovery and hidden text recovery. The below images has hidden text and it needs to recovered by using the stenography tool. It is shown below

First, open stenography software. It is shown below.

After, click the images and select the stenography analysis. It is shown below.

After, open the image and enter the symmetric key. Then it shows the hidden text in images. It is shown below.

The Pro Discover tool is used to recover the all the files from USB. Here, we are recover the EMTS organization Hard disk files because it lost the suspicious data. So, it needs to recovered by using the pro discover tool. This process is shown below. First, open the Pro Discover tool and create the new project. Then click Ok button.

After, add the images to locate the hard drive. It is shown below.

First, users are adding the image. After, click the content view to expend the location of hard drive. Then expend the overall hard drive. It is shows the lost files. Then right click the user want files and choose the copy to save the files. It is shown below.

Conclusion

This project is to prepare a digital forensic report the given scenario. So we recovered the deleted file which has suspicious data that relevant to the case files from USB. The appropriate digital forensics tools were used to accomplish recover process. In our case study, we have applied to use Winhex to recover the deleted image in the USB. The Stenography tool is used for recovering the hidden text in Image. Then using the Remo recovery, we recover the pdf file. So these recovery techniques need to be analysed before we proceed to findings.

References

AG, X. (2018). WinHex: Hex Editor & Disk Editor, Computer Forensics & Data Recovery Software. Retrieved from https://www.x-ways.net/winhex/

Best Tools to Perform Steganography. (2018). Retrieved from https://resources.infosecinstitute.com/steganography-and-tools-to-perform-steganography/#gref

Best Tools to Perform Steganography. (2018). Retrieved from https://resources.infosecinstitute.com/steganography-and-tools-to-perform-steganography/#gref

Flandrin, F. (2018). Evaluating Digital Forensic Tools. Retrieved from https://www.napier.ac.uk/~/media/worktribe/output-178532/flandrinpdf.pdf

Recover Data from Windows PC using Remo Data Recovery Software. (2018). Retrieved from https://www.remosoftware.com/remo-recover-windows

Remo Recover – Recover data / files from Windows, Mac and Android OS. (2018). Retrieved from https://www.remorecover.com/

WinHex: A powerful data recovery and forensics tool. (2018). Retrieved from https://www.techrepublic.com/article/winhex-a-powerful-data-recovery-and-forensics-tool/