In this paper we present a practical method for recovery of deleted files from a locally accessible data storage, such as an HDD, with an optional recording of evidential information about the recovery process. Our approach puts strong emphasis on the practical aspect of file recovery and evidence recording as well as the accessibility of the required tools. This makes it useful for a variety of tasks ranging from simple recovery of personal files to collection of evidence in digital forensic processes.
['Kenan Kalajdzic', 'Ahmed Patel']
A fast scheme for recovery of deleted files with evidential recording for digital forensics.