Deleted And Corrupted File Restoration And Safety

References

[3] By, William H. Allen, Nasser S. Alamri Research in file-type identification has employed a number of different approaches to classify unknown files according to their actual file type. In this paper, a comparison of five common file-type identification approaches, along with the parameters used to perform the comparisons. All approaches were evaluated with the same dataset which was drawn from public or widely available sources. The results of this paper show that each approach can produce good results with 88% to 97% classification rates, but achieving these results requires “tuning” the parameters of the inputs to the classifiers.  An Approach for the Validation of File Recovery Functions in Digital Forensics’ Software Tools

[4] By, Sultan Al Sharif1, Mohamed Majed Al Ali, Naser Salem, Farkhund Iqbal, May El Barachi, and Omar Alfandi Recovering lost and deleted information from computer storage media for the purpose of forensic investigation is one of the essential steps in digital forensics. There are several dozens of commercial and open source digital analysis tools dedicated for this purpose. The challenge is to identify the tool that best fits in a specific case of investigation. To measure the file recovering functionality, we have developed a validation approach for comparing five popular forensic tools: Encase, Recover my files, Recover, Blade, and FTK. These tools were examined in a fixed scenario to show the differences and capabilities in recovering files after deletion, quick format and full format of a USB stick. Experimental results on selected commercial and open source tools demonstrate effectiveness of proposed approach. By getting all this information one better software can be created. V. PROPOSED SOLUTION In our project, we propose a system m that would allow the user to perform different tasks such as identifying the file extensions, recovering deleted data from the storage media and encrypting any file that needs to be secured by the user. The Block Diagram for our proposed solution is as We aim to build a forensic tool that would help the investigators and ease their task by automating most of the processes in the system. This would also save some of their time as they would just have to select files to be identified, restored or encrypted.  Hex View: The name 'hex' comes from 'hexadecimal': a standard numerical format for representing binary data. A typical computer file occupies multiple areas on the platter(s) of a disk drive, whose contents are combined to form the file. Hex editors that are designed to parse and edit sector data from the physical segments of floppy or hard disks are sometimes called sector editors or disk editors. A user can see or edit the raw and exact contents of a file, as opposed to the interpretation of the same content that other, higher level application software may associate with the file format. For example, this could be raw image data, in contrast to the way image editing software would interpret and show the same file. Hex view can also interpret and view contents of documents (.txt, .docx etc.). The data of the computer file is represented as hexadecimal values grouped in 4 groups of 4 bytes (or two groups of 8 bytes), followed by one group of 16 printable ASCII characters which correspond to each pair of hex values (each byte). Non-printable ASCII characters (e.g., Bell) and characters that would take more than one-character space (e.g., tab) are typically represented by a dot (".") in the following ASCII field.  To Find Hidden Data: One method is the file deletion technique, here when a file is deleted; the record of the file is removed from the table so it appears, as the file no longer exists. Although the record is gone, the file may still exist on the cluster. Partition deletion is similar to file deletion where the record may be gone but the file still resides on the hard disk. A file extension or file name extension is the ending of a file that helps identify the type of file in operating systems, such as Microsoft Windows. In Microsoft Windows, the file name extension is a period that is often followed by three characters, but may also be one, two, or four characters long. Sometimes these extensions can be changed by a user to rename it. In such scenario the os will identify the file and will try to read or execute that file in other program. Due to this the file won’t open and user might think it is corrupted. The context of the file remains the same. In such cases, we have to manually check the hex value of the file in order to verify the file type. Hex values of the files are used as they store all the information of the file including the file type information, which shows the extension, in which the file should be stored.  Hidden File Extension: In such cases, the investigators have to manually check the hex value of the file in order to verify the file type. Hex values of the files are used as they store all the information of the file including the file type information, which shows the extension, in which the file should be stored.  File Restoration: Files can be recovered by calculating the starting and the end of the file in hex format and copying it into a text file and saving it into the appropriate extension. The common problem with deleting files is accidental removal of information that later proves to be important. One way to deal with this is to back up files regularly. Erroneously deleted files may then be found in archives, but what if the file was not backed up? Although many times deleted file are present in recycle bin but we may also delete the file permanently which cannot be recovered in recycle bin or from temp folder. Operating system uses various File system such as FAT 16, NTFS etc. to store and read data. These file systems manage a Storage table which uses indexing to store and point towards the next address. When file is deleted its data is not deleted. Instead its entry from file table is wiped out. We can use enumeration and base address to calculate hidden address and restore the files. File can only be restored as long as they aren’t overwritten by another file. In such case it becomes very difficult to capture and restore such files.  1.3.4 Data Security: Securing or hiding the data of the user using the methods of the attacker itself. These methods consist of data hiding in the hidden compartments of another file, changing the extension of the file to be secured. Flow Chart and the Screenshots of the solution Chart: VI. ACKNOWLEDGEMENT We wish to express our profound gratitude to our principal Dr. Bhavesh Patel for allowing us to go ahead with this project and giving us the opportunity to explore this domain. We would also like to thank our Head of Department Prof. Uday Bhave for our constant encouragement and support towards achieving this goal. We would also like to thank the Review Committee for their invaluable suggestions and feedback without whom our work would have been very difficult. We take this opportunity to express our profound gratitude and deep regards to our guide Prof. Sonali Bhutad for his exemplary guidance, monitoring and constant encouragement throughout the course of this project. The blessing, help and guidance given by him from time to time shall carry us a long way in the journey of life on which we are about to embark. No project is ever complete without the guidelines of these experts who have already established a mark on this path before and have become masters of it. So, we would like to take this opportunity to thank all those who have helped us in implementing this project. REFERENCES

[1] Research Journal “Digital Forensic Investigation on File System and Database Tampering, By Sindhu. K. K, Shweta Tripathi, Dr. B. B. Meshram”,

[2] Book “Computer Hacking Forensic Investigator, By EC-Council”,

[3] Research Paper “A Comparative Study of File- Type Identification Techniques By William H. Allen, Nasser S. Alamri”,

[4] Research paper “An Approach for the Validation of File Recovery Functions in Digital Forensics’ Software Tools, By Sultan Al Sharif1, Mohamed Majed Al Ali, Naser Salem, Farkhund Iqbal, May El Barachi, and Omar Alfandi”.