Disk Image Analysis And Deleted File Recovery Tool — Complete Documentation & Simulation

Overview & System Context

Disk Image Analysis And Deleted File Recovery Tool: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~5741 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background In computing, data recovery is a process of retrieving deleted, inaccessible, lost, corrupted, damaged, or overwritten data from secondary storage, removable media or files, when the data stored in them cannot be accessed in a usual way. The data is most often salvaged from storage media such as internal or external hard disk drives (HDDs), solid-state drives (SSDs), USB flash drives, magnetic tapes, CDs, DVDs, RAID subsystems, and other electronic devices. Recovery may be required due to physical damage to the storage devices or logical damage to the file system that prevents it from being mounted by the host operating system (OS). Logical failures occur when the hard drive devices are functional but the user or automated-OS cannot retrieve or access data stored on them. Logical failures can occur due to corruption of the engineering chip, lost partitions, firmware failure, or failures during formatting/re-installation. Data recovery can be a very simple or technical challenge.

Therefore, specialized software companies and professionals work in this field to help extract data from faulty computer systems. A common misconception is that a damaged printed circuit board (PCB) may be simply replaced during recovery procedures by an identical PCB from a healthy drive. While this may work in rare circumstances on hard disk drives manufactured before 2003, it will not work on newer drives. Electronics boards of modern drives usually contain drive-specific adaptation data (generally a map of bad sectors and tuning parameters) and other information required to properly access data on the drive.

Replacement boards often need this information to effectively recover all of the data. The replacement board may need to be reprogrammed. Some manufacturers (Seagate, for example) store this information on a serial EEPROM chip, which can be removed and transferred to the replacement board. Each hard disk drive has what is called a system area or service area; this portion of the drive, which is not directly accessible to the end user, usually contains drive's firmware and adaptive data that helps the drive operate within normal parameters. One function of the system area is to log defective sectors within the drive; essentially telling the drive where it can and cannot write data. The sector lists are also stored on various chips attached to the PCB, and they are unique to each hard disk drive. If the data on the PCB do not match what is stored on the platter, then the drive will not calibrate properly. In most cases the drive heads will click because they are unable to find the data matching what is stored on the PCB.

The term logical damage refers to situations in which the error is not a problem in the hardware and requires software-level solutions. After data has been physically overwritten on a hard disk drive, it is generally assumed that the previous data are no longer possible to recover. In 1996, Peter Gutmann, a computer scientist, presented a paper that suggested overwritten data could be recovered through the use of magnetic force microscopy. In 2001, he presented another paper on a similar topic. To guard against this type of data recovery, Gutmann and Colin Plumb designed a method of irreversibly scrubbing data, known as the Gutmann method and used by several disk-scrubbing software packages. Substantial criticism has followed, primarily dealing with the lack of any concrete examples of significant amounts of overwritten data being recovered. Gutmann's article contains a number of errors and inaccuracies, particularly regarding information about how data is encoded and processed on hard drives. Although Gutmann's theory may be correct, there is no practical evidence that overwritten data can be recovered, while research has shown to support that overwritten data cannot be recovered. Solid-state drives (SSD) overwrite data differently from hard disk drives (HDD) which makes at least some of their data easier to recover. Most SSDs use flash memory to store data in pages and blocks, referenced by logical block addresses (LBA) which are managed by the flash translation layer (FTL). When the FTL modifies a sector it writes the new data to another location and updates the map so the new data appear at the target LBA. This leaves the pre-modification data in place, with possibly many generations, and recoverable by data recovery software.

Figure 1: 10 Best Photo Recovery Software (2026) - Tested & Ranked Phase 1 Repair the hard disk drive The hard drive is repaired in order to get it running in some form, or at least in a state suitable for reading the data from it. For example, if heads are bad they need to be changed; if the PCB is faulty then it needs to be fixed or replaced; if the spindle motor is bad the platters and heads should be moved to a new drive. Phase 2 Image the drive to a new drive or a disk image file When a hard disk drive fails, the importance of getting the data off the drive is the top priority. The longer a faulty drive is used, the more likely further data loss is to occur. Creating an image of the drive will ensure that there is a secondary copy of the data on another device, on which it is safe to perform testing and recovery procedures without harming the source. Phase 3 Logical recovery of files, partition, MBR and filesystem structures After the drive has been cloned to a new drive, it is suitable to attempt the retrieval of lost data. If the drive has failed logically, there are a number of reasons for that. Using the clone it may be possible to repair the partition table or master boot record (MBR) in order to read the file system's data structure and retrieve stored data. Phase 4 Repair damaged files that were retrieved Data damage can be caused when, for example, a file is written to a sector on the drive that has been damaged. This is the most common cause in a failing drive, meaning that data needs to be reconstructed to become readable. Corrupted documents can be recovered by several software methods or by manually reconstructing the document using a hex editor.

Data recovery cannot always be done on a running system. As a result, a boot disk, live CD, live USB, or any other type of live distro contains a minimal operating system. BartPE: a lightweight variant of Microsoft Windows XP or Windows Server 2003 32-bit operating systems, similar to a Windows Preinstallation Environment, which can be run from a live CD or live USB drive. Discontinued. Finnix: a Debian-based Live CD with a focus on being small and fast, useful for computer and data rescue Disk Drill: capable of creating bootable macOS USB drives for data recovery Knoppix: contains utilities for data recovery under Linux SystemRescue: an Arch Linux-based live CD, useful for repairing unbootable computer systems and retrieving data after a system crash Grml: A Debian-based live-system for system administrators. Windows Preinstallation Environment (WinPE): A customizable Windows Boot DVD (made by Microsoft and distributed for free). Can be modified to boot to any of the programs listed.

Foremost: an open-source command-line file recovery program, originally developed by the Air Force Office of Special Investigations and NPS Center for Information Systems Security Studies and Research Forensic Toolkit: by AccessData, used by law enforcement Open Computer Forensics Architecture: An open-source program for Linux The Coroner's Toolkit: a suite of utilities for assisting in forensic analysis of a UNIX system after a break-in The Sleuth Kit: also known as TSK, a suite of forensic analysis tools developed by Brian Carrier for UNIX, Linux and Windows systems. TSK includes the Autopsy forensic browser.

Figure 2: O&O DiskRecovery 14 - O&O Software GmbH Clonezilla: a free disk cloning, disk imaging, data recovery, and deployment boot disk dd: common byte-to-byte cloning tool found on Unix-like systems ddrescue: an open-source tool similar to dd but with the ability to skip over and subsequently retry bad blocks on failing storage devices Team Win Recovery Project: a free and open-source recovery system for Android devices File system forensics is a critical discipline within digital forensics that focuses on analyzing file systems to recover deleted data, understand file operations, and reconstruct digital evidence. When files are “deleted” from a computer system, they’re rarely completely erased immediately, making recovery possible through various forensic techniques.

The foundation of file system forensics lies in understanding how operating systems manage data storage. Modern file systems use complex structures including metadata tables , allocation bitmaps , and journaling mechanisms that can preserve traces of deleted files long after they appear to be gone. Contrary to popular belief, when you delete a file, the operating system doesn’t immediately overwrite the actual data. Instead, it follows a multi-step process: Figure 3: Deleted File Recovery Software Free Download Full Version Windows 10 NTFS (Windows) : Uses Master File Table (MFT) entries that contain file metadata. Deleted files often remain in the MFT with modified attributes, and the actual data persists in unallocated clusters until overwritten.

ext4 (Linux) : Employs inodes to store file metadata. When files are deleted, inode entries are marked as free, but the underlying data blocks typically remain intact until reused by new files. APFS (macOS) : Features copy-on-write semantics and snapshots, which can preserve deleted file data in previous filesystem states even after standard deletion.

File slack space occurs when a file doesn’t completely fill its allocated cluster. The unused portion of the final cluster may contain remnants of previously deleted files, creating a goldmine for forensic analysis. Unallocated space represents areas of the storage medium not currently assigned to any file. This space frequently contains complete or partial deleted files and is a primary target for recovery operations.

File carving is the process of extracting files from unallocated space without relying on file system metadata. This technique uses file signatures (magic numbers) to identify file beginnings and ends. This approach leverages residual filesystem metadata to locate and recover deleted files. Tools analyze structures like the MFT in NTFS or inode tables in ext filesystems to find entries marked as deleted but still containing valid data pointers.

File carving searches raw disk data for known file signatures, enabling recovery even when metadata is corrupted or overwritten. Advanced carving techniques include: Modern filesystems maintain journals or logs that record file operations. These structures can provide valuable information about deleted files, including: TestDisk and PhotoRec : Open-source utilities for partition recovery and file carving respectively.

Sleuth Kit (TSK) : Comprehensive forensic analysis framework with command-line tools for various recovery tasks. EnCase : Industry-standard commercial forensic platform with advanced deleted file recovery capabilities, including predictive file carving and timeline analysis. FTK (Forensic Toolkit) : Comprehensive forensic suite featuring automated deleted file detection, advanced searching, and integrated reporting capabilities.

X-Ways Forensics : Powerful forensic tool with sophisticated carving algorithms, including support for custom file types and fragmented file reconstruction. Fragmented files present significant recovery challenges as their data blocks are scattered across the storage medium. Advanced techniques include: When deleted files are partially overwritten, forensic analysts employ several strategies: Modern encrypted filesystems (FileVault, BitLocker, LUKS) complicate recovery efforts. Successful recovery typically requires: Imaging : Always work with forensic images rather than original media to preserve evidence integrity. Use tools like dd , dcfldd , or commercial imaging solutions that generate cryptographic hashes for verification.

Solid-state drives introduce unique challenges for deleted file recovery due to wear leveling, TRIM commands, and garbage collection. Recovery strategies must account for: File system forensics and deleted file recovery represent critical capabilities in modern digital investigations. As storage technologies evolve and data protection mechanisms become more sophisticated, forensic practitioners must continually adapt their techniques and tools.

2. System Architecture & Core Working Principles Success in this field requires a deep understanding of filesystem internals, proficiency with specialized recovery tools, and adherence to strict forensic protocols. Whether investigating cybersecurity incidents, conducting legal discovery, or performing data recovery operations, the principles and techniques outlined in this guide provide a solid foundation for effective file system forensics.

The future of deleted file recovery will likely see increased integration of artificial intelligence, enhanced support for emerging storage technologies, and continued evolution of legal frameworks governing digital evidence. Staying current with these developments while maintaining rigorous technical and ethical standards remains essential for forensic professionals in this rapidly advancing field.

Digital Forensics Master Guide: Disk Imaging, SHA-256 Hashing, Evidence Integrity & DFIR Investigation (Beginner to Architect Level) Digital Forensics and Incident Response (DFIR) is the scientific process of collecting, preserving, analyzing, and presenting digital evidence. This complete master guide takes you step-by-step from beginner concepts to advanced forensic architecture used by professional investigators, SOC analysts, and cybersecurity experts.

Digital forensics focuses on investigating digital devices after security incidents, cybercrime, or legal disputes. The primary goal is to preserve evidence without altering it. Disk imaging is the process of creating an exact bit-by-bit copy of a storage device. Unlike normal copying, forensic imaging captures all sectors including deleted data.

The original storage device containing data under investigation. Investigators must avoid modifying it. Deleting files usually removes only filesystem references. The data remains until overwritten. Digital forensics combines low-level disk analysis, cryptographic validation, and investigative methodology. Understanding the progression from basic imaging to advanced forensic architecture enables cybersecurity professionals to conduct reliable and legally defensible investigations.

The Sleuth Kit (TSK) is a collection of command-line tools used in digital forensics to analyze disk images, examine file systems, and recover deleted data without altering the original evidence. Autopsy provides a graphical interface for TSK, making analysis more accessible and efficient while preserving forensic integrity. Ingest modules define how the data will be analyzed. Selecting the right modules is critical for effective investigation.

Note: It is usually advised to not scan or extract any suspected files/ disks such as payload files, etc. in the main system, rather scan them in safe environments such as a virtual machine, and then extract the data, as they hold the possibility of being corrupt and may infect the examiner's system with viruses. File system forensics involves the detailed examination of file systems to uncover evidence of malicious activity, recover deleted files, and analyze the structure and integrity of the system. Autopsy and Sleuth Kit are powerful tools used in digital forensics for these purposes. This advanced-level lab will guide you through complex forensic tasks using these tools, including advanced file recovery, timeline analysis, and detecting data obfuscation.

Objective : Acquire a disk image with specific partitions for detailed forensic analysis. Objective : Use Sleuth Kit to conduct a detailed analysis of the file system structure and identify hidden data. Objective : Create and analyze a timeline of file system activities using Sleuth Kit tools. Expected Output : A detailed timeline of file system activities highlighting suspicious events.

Objective : Use Sleuth Kit and Autopsy to recover and analyze deleted files from the disk image. Objective : Identify and analyze techniques used to obfuscate or manipulate data within the file system. Expected Output : Identification of data obfuscation techniques and detailed analysis of manipulated data. By completing these exercises, you have gained advanced skills in file system forensics using Autopsy and Sleuth Kit. You have learned to acquire and verify disk images, conduct detailed file system analysis, create timelines of system activities, recover deleted files, and detect data obfuscation. These skills are essential for performing comprehensive forensic investigations and uncovering hidden evidence in complex cases.

I am a cybersecurity trainer with a passion for teaching and helping others learn essential cybersecurity skills through practical, hands-on projects. Connect with me on social media for more updates and resources: Hands-on lab for file system forensics using Autopsy and Sleuth Kit, focusing on disk image acquisition, file system analysis, timeline creation, file recovery, and detecting data obfuscation.

Last summer i had a course on digital forensics basics in university. I loved digging for clues and information, yet the documentation part of it all, somehow bringing in a legal context aswell, kind of bothered me and my colleagues. We decided to change that, to make documentation as seamless as possible for our purposes. forensic-log-tracker is the outcome of this. Picture this: a Linux machine gets flagged. Someone deleted something they shouldn't have. You're handed the system, told to investigate, and, after twenty minutes with the right tools, you recover the file.

In a real DFIR engagement, that documentation is the investigation. In a CTF with forensics scoring, it's what separates a flag submission from an actual write-up worth reading. And if you ever want to work in incident response professionally, chain of custody isn't optional but rather the actual job . Most beginner forensics guides teach you the recovery part. Almost none of them teach you the documentation part. This one does both.

You don't need special hardware, a seized hard drive, or a professional forensics workstation. Everything in this guide runs on a standard Linux terminal: Kali, Ubuntu, Debian, all work fine. Instead of building a disk image from scratch, I've prepared one for you. It's a 20MB ext4 image with several deleted files hidden inside, along with some stuff that carving tools alone won't find. Your job is to recover them.

You should see lab01.img: OK . If you don't, re-download before continuing. A hash mismatch means the file is corrupted or modified. On first run, flt initializes most of your config automatically, yet you still have to do 3. Software Implementation, Frameworks & Protocols Just go with the GPG setup, it is there to cryptographically testify that nothing was altered by you in your research :D You actually don´t need to use your real name for this yet in an official matter it would be wise. I did it like this for now: Now open ~/.config/forensic-log-tracker/config.yaml and set your analyst name before continuing; it gets embedded in every log entry.

The moment you mount a disk, your OS starts writing to it: access timestamps update, journal entries get created, metadata shifts. Even reading a file changes things. lab01.img is your original. You'll make a working copy of it in the next step, and that copy is what every subsequent command will touch. The original stays exactly as it was when you verified that hash.

Before Foremost and Scalpel can do anything, you need a working copy of lab01.img to investigate. This is where dd comes in.. and where most beginners skip a step they'll later regret. dd stands for Disk Dump . It's a Unix tool that's been around since the 1970s and does exactly one thing: copy data block by block, byte by byte, without caring about filesystems, file names, or structure. It sees your disk the way a photocopier sees a document; it doesn't read words, it copies pixels.

That property is what makes it forensically valuable. When you copy a file with cp , the operating system interprets the filesystem and gives you the file's contents. When you copy with dd , you get everything, including the empty space, the deleted sectors, the fragments between files. That's exactly where your evidence hides. conv=noerror,sync together is the forensic standard. A real damaged drive will have bad sectors. Without these flags, dd would stop at the first read error and you'd lose everything after it. With them, you get a complete image with problem areas marked as zeros: recoverable, documented, intact.

Both hashes should be identical. If they are, you have a verified, pristine copy of the original and you can prove it. If they differ, something went wrong during the copy. Run it again before continuing. Each command gets logged with its output, a SHA256 hash of that output, a timestamp, and a formal explanation of what the command does, automatically with forensic-log-tracker . Your investigation timeline has already started. Congratulations! Before running carving tools, it helps to understand what the filesystem looks like. You can query the image directly without mounting it: This shows you the partition table, whether it's MBR or GPT, where partitions start, what filesystem types are present. For lab01.img you'll see a single ext4 partition.

If you want to dig one level deeper and see what files the filesystem still knows about (including entries for deleted files), use fls from the Sleuth Kit: You'll notice something interesting: even though files were deleted, some of their names still appear in the output, marked with an asterisk . The filesystem remembers that something was there, even if it can't give you the contents back through normal means. That's what the next two tools are for.

If terms like ext4, inodes, or partition tables are new and difficult to you, I covered all of that in depth in my forensics challenge series , worth reading before continuing. At this point you should have working_copy.img on disk, two matching SHA256 hashes, an active flt case with three logged entries, and a rough picture of what the filesystem contains. If anything is missing, go back before continuing. Everything from here builds on this foundation.

You've got a verified working copy and a case log already running. The filesystem told you something was deleted. Now we go get it back. Before running anything, it's worth understanding what's happening under the hood because it changes how you interpret the results.

When a file gets deleted on Linux, the OS doesn't wipe the actual bytes. It just updates the directory entry to say "this space is available." The raw data sits on disk, untouched, until something else gets written over it . File carving exploits exactly that. Instead of asking the filesystem "what files exist?" , carving tools scan the raw disk byte by byte, looking for known file signatures , specific byte sequences that mark the beginning and end of known file types.

Foremost knows hundreds of these signatures. It scans your image from start to finish, finds, e.g., a FF D8 FF , calls that the start of a JPEG, then keeps reading until it hits FF D9 , and extracts everything in between as a recovered file. This is also why plain text files are harder to recover with carving tools. A .txt file has no magic bytes. There's no universal "text file starts here" signature, it's just... characters. We'll come back to that limitation in a moment.

This is the most important output Foremost produces, and most beginners ignore it. Open it: It tells you exactly where on the disk each file was found, its byte offset . In a real investigation, this offset is evidence: it tells you where on the physical disk the file lived, which can help establish whether files were planted, copied, or native to the system.

Foremost didn't recover that. It never will, because plain text has no magic bytes for Foremost to find. This is one of the most important things to understand about file carving: it only finds what it has signatures for. A skilled investigator doesn't stop at carving. They also run strings on the raw image, search for keywords, check filesystem metadata with fls , and use multiple tools in combination. The flag you just found with strings is your reminder that no single tool tells the whole story.

Fragmented files. Foremost assumes a file's bytes are contiguous on disk. If a file was fragmented across non-adjacent blocks (common on heavily used drives), Foremost will either miss it or recover a corrupted version. Scalpel handles this better in some configurations. Fixed signature list. Foremost ships with a default /etc/foremost.conf that covers common file types. If you need to find something unusual, like a custom binary format, a proprietary database file, Foremost can't help without significant modification. Scalpel is built for exactly that use case, which is what the next section covers.

At this point Foremost should have recovered at least one JPEG and one PDF from working_copy.img , both logged in your flt case. You've also found something Foremost couldn't, the text flag, using strings directly on the raw image. The core difference isn't really about power but rather philosophy kind of. Foremost ships ready-to-run with a built-in signature list and sensible defaults.

That sounds like more work. It is. It's also exactly what you want in a real investigation. 4. Practical Deployment, Analysis & Case Studies Both tools scan raw disk data for file signatures. But where Foremost makes decisions for you, Scalpel puts you in control of three things: What to look for. Every file type Scalpel searches for must be explicitly enabled in its config file. Nothing runs by default.

How far to look. You define the maximum file size for each type. Scalpel won't carve beyond that limit, which prevents it from extracting hundreds of megabytes of garbage when it finds a header with no matching footer. What the boundaries are. You define both the header and footer for each file type. If a format has no footer, you define the maximum size and Scalpel carves that many bytes from the header forward.

This config-driven approach makes Scalpel significantly more precise on known targets and significantly more useful when you're hunting for something Foremost doesn't know about. Unlike Foremost, Scalpel does nothing until you tell it what to find. Open the config file: You'll see a long list of file types, all commented out with # . Find the JPEG and PDF entries and uncomment them. They look like this: Scalpel will refuse to run if the output directory already exists, it won't overwrite previous results , very important feature. If you need to rerun it: Scalpel names its subdirectories after the exact rule that matched — you can see the file type, the case-sensitivity flag, and the size limit right in the folder name. That's intentional: it makes your investigation log unambiguous.

Open the recovered files and verify they're intact. If both open correctly, Scalpel confirmed what Foremost found — with a different engine and explicit rules you can audit. Scalpel didn't find the txt either. And it never will, because the Foremost-limitation from earlier applies here too. At this point you've run both tools on the same image. Here's what that comparison actually means: Neither tool is better. They answer different questions. Foremost is your first pass, fast, broad, automatic. Scalpel is your second pass, deliberate, precise, auditable. In a real investigation you run both.

This is worth pausing on. In a real forensic investigation, being able to show exactly which signatures you searched for — and which you didn't — matters. Scalpel's config file is a document. It records your investigative decisions: what you looked for, what size limits you set, what you chose to exclude. Combined with your flt case log, you can reconstruct every decision you made during the investigation, in order, with timestamps and signatures.

That's chain of custody extending beyond just the evidence — it covers your methodology too. This embeds a snapshot of your exact Scalpel configuration into your case log at the moment you ran the investigation. If the config ever changes on the system later, your log still shows what rules were active when you ran it. You should now have recovered files in both foremost_output/ and scalpel_output/ , with every command logged and signed in your flt case. Run flt report -c practicing01 and look at what you've built: a complete, timestamped, GPG-signed record of an investigation.

You have recovered files, found a hidden flag, and logged every step. Now close the case. That's it. forensic-log-tracker reads every log entry in your case folder — every command, every output hash, every GPG signature, every timestamp — and assembles them into a single Markdown report at logs/practicing01/practicing01_report.md.

Open it. What you're looking at is a complete, chronological record of everything you did — from the first sha256sum on the original image to the final Scalpel run. Every command is there. Every output excerpt is there. Every hash is there. Every entry is signed. This is what you hand to a supervisor. This is what you attach to a CTF write-up. This is what you put in front of a professor who asks you to prove you didn't tamper with the evidence.

You started this post with a downloaded disk image and no forensics experience. You now know how to: That last point is the one most guides skip. The tools are learnable in an afternoon. The discipline of documentation is what separates someone who did forensics from someone who can prove what they found. This was one image with a few planted files. Real investigations are messier — fragmented drives, encrypted volumes, wiped partitions, anti-forensic tools designed to defeat exactly what you just learned.

forensic-log-tracker is a student project born out of frustration with documentation. If you hit a bug, found a limitation, or have a feature idea, open an issue. That's how it gets better. This project demonstrates a comprehensive digital forensics investigation workflow on Windows using FTK Imager for evidence acquisition and Autopsy for analysis. The implementation covers forensic imaging, evidence preservation, and detailed analysis of digital artifacts for investigative purposes.

Digital forensics capabilities are essential for organizations to conduct internal investigations, respond to security incidents, and support legal proceedings. Proper evidence handling ensures compliance with regulatory requirements and maintains evidentiary integrity. A company suspects unauthorized disclosure of confidential business information and personally identifiable information (PII).

The forensic investigation involves: Comprehensive hands-on digital forensics lab for partition recovery and file carving using TestDisk, Foremost, and Scalpel. Complete tutorial with lab creation using fdisk, partition table analysis, and forensic validation techniques. DiskForensics parses raw disk images at the byte level — reading MBR and GPT partition tables, FAT32 and NTFS filesystem metadata, recovering deleted files, generating forensic timelines, and producing investigation-ready reports.

This is what tools like Autopsy , FTK (Forensic Toolkit) , and EnCase do under the hood. DiskForensics is a ground-up Python implementation using only the struct module for binary parsing, with zero native code dependencies. 5. Performance Evaluation & Extended Technical Observations This generates three synthetic disk images and runs a full forensic analysis on each, demonstrating every capability of the tool.

Performs a complete examination: detects partition scheme, identifies filesystem types in each partition, summarizes file counts, and reports detected deletion. Displays the MBR or GPT partition table with LBA ranges, partition types, sizes, and (for GPT) type GUIDs and partition names.

Lists all files in the specified partition's filesystem (FAT32 or NTFS), including timestamps, file sizes, and cluster/MFT record numbers. Scans for deleted directory entries (FAT32: 0xE5 marker; NTFS: not-in-use MFT flag). Reports each deleted file with recovery assessment: whether the original data clusters are still free (FAT32) or MFT attributes are intact (NTFS).

Generates a chronological timeline of all filesystem events (file created, modified, accessed, deleted) from all partitions. Supports date-range filtering. Computes MD5, SHA-1, and SHA-256 hashes of the full disk image and each detected partition. Reports throughput and computation time.

Generates a complete forensic report including all hashes, partition table, filesystem contents, deleted file recovery, and timeline. Master Boot Record (MBR) — the original partitioning scheme, used since IBM PC-DOS in the early 1980s. Sector 0 of the disk contains: MBR limitations: maximum 4 primary partitions, maximum 2 TB disk size (with 512-byte sectors).

From a forensic standpoint , the presence and integrity of both MBR/GPT structures and their backup copies tells investigators whether data may have been deliberately modified, and helps establish the disk's original layout. Introduced with Windows 95 OSR2 in 1996. Widely used on removable media (USB drives, SD cards) and embedded systems because of its simplicity and broad OS support.

FAT32 limitations: maximum file size 4 GB – 1 byte, no built-in access control, no journaling. Introduced with Windows NT 3.1 in 1993. Used on all modern Windows systems and increasingly on Linux (via ntfs-3g). Designed for enterprise reliability, security, and large volumes. NTFS timestamps: 100-nanosecond precision, UTC timezone, epoch January 1, 1601. Converting to Unix time: subtract 116444736000000000 intervals (11644473600 seconds).

Forensic significance of $SI vs $FN timestamps: A key anti-forensic technique called timestomping modifies $STANDARD_INFORMATION timestamps to make a file appear older or unrelated to the crime window. However, $FILE_NAME timestamps are updated by the NTFS driver at a different time and are not accessible via standard Win32 API calls. Discrepancies between $SI and $FN timestamps are a strong indicator of manipulation.

The 0xE5 marker means DiskForensics can still read the directory entry's timestamps, file size, and the starting cluster number. The 8.3 name's first character is lost (it becomes _ in our output). The rest of the entry is intact. Because the $STANDARD_INFORMATION and $FILE_NAME attributes are preserved, NTFS deletion recovery provides: This is why NTFS forensics is so powerful: deleted file metadata is nearly always recoverable unless the MFT record has been overused. Tools like Autopsy, FTK, and EnCase exploit this exact mechanism to build lists of previously existing files.

A forensic timeline places all filesystem events in chronological order to help investigators reconstruct what happened and when. DiskForensics collects: The MACB (Modified/Accessed/Changed/Birth) timestamp model is the standard forensic framework for describing filesystem time evidence: In a normal file lifecycle, Birth ≤ Modified ≤ Accessed ≤ Changed. Violations of this ordering (e.g., Modified time before Birth time) strongly suggest timestamp manipulation.

Chain of custody in digital forensics requires that every action taken on evidence be documented and verifiable. For disk images: Acquisition : The disk is imaged using a write blocker — a hardware or software device that prevents any writes to the evidence disk. dd , dcfldd , FTK Imager , and Guymager are common acquisition tools. The raw output is a .dd (raw) image.

Hashing at acquisition : Immediately after imaging, compute hash digests of the source disk and the resulting image. If they match, the image is a forensically sound copy. Common standards: MD5 + SHA-256 together. Working copies : Never analyze the original image directly. Mount or analyze copies. The original's hash should be reverified at every step.

Hash verification : DiskForensics computes MD5, SHA-1, and SHA-256 of the full image and each partition. These values go directly into the forensic report as evidence of image integrity throughout the examination. All parsers accept an ImageReader instance and a partition_lba_start offset, making them composable: point any parser at any partition within any image.

All tests use synthesized binary disk images created by sample_images/generate_sample.py . No pre-built test fixtures are required — images are generated on-the-fly in temporary directories and cleaned up after tests complete. DiskForensics implements the core byte-level parsing that powers commercial forensic suites: DiskForensics is designed for education, research, and Python-based forensic automation. For production investigations on large (500 GB+) disk images, The Sleuth Kit or commercial tools provide the necessary performance and evidentiary certification.

Disk image forensics analyzer — pure Python MBR/GPT/FAT32/NTFS parsing, deleted file recovery, forensic timeline generation Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Data%20recovery • https://codelucky.com/file-system-forensics-deleted-recovery/ • https://www.learncyber.in/2026/02/digital-forensics-master-guide-disk.html • https://www.geeksforgeeks.org/techtips/analysis-of-data-source-using-autopsy/ • https://github.com/0xrajneesh/File-System-Forensics-with-Autopsy-and-Sleuth-Kit • https://niklas-heringer.com/digital-forensics/digital-forensics-for-beginners/ • https://github.com/Fkmanny/digital-forensics-deleted-file-recovery-windows • https://github.com/SecArt1/digital-forensics-partition-recovery-lab • https://github.com/marez8505/DiskForensics