Open Source Forensic Hard Drive Recovery Tools
Forensic Software
The work of computer forensic practitioners would be nearly impossible without software tools and hardware equipment for examining various media. While computer forensic tools are highly specialized and costly in many respects, there are many open source offerings as well.
While powerful software solutions, such as X-Ways Forensics, offers a wide array of features to analyse the structure and contents of deleted and existing files to form an idea of the overall disk space usage while displaying the results in a drive contents table. Still, some users want the flexibility to customize the forensic tools they use. Here are some open source forensic software options to consider.
Open Source Forensic Hard Drive Recovery Tools
File Ripper – This program can be used as a forensic tool to recover files where file system information has been lost or otherwise
corrupted, or where files have been deleted. It can detect and extract PNG, ANS, ZZT, FRM, text BAS, BMP, HTML, GIF, ZIP, DOC, MZX, LBM, PBM, ANM, BAT, BAS, RTF, HLP, WAV, WRI, JPG, ARJ, DOS EXE, MZB, FLI, MSP, LZH/LHA, MOD, XM, VOC, SVX, GDM, IT, S3M, SAV, BRD, ABM, Quetzal, and even some obscure bulletin board formats.
Source: https://directory.fsf.org/project/fripper/
Author: Kristofer Munsterhjelm – Maintainer
Disktype - This tool is written in C and should compile easily to run on any modern UNIX environment. Disktype is designed to detect the contents of disks and partitions once they are in well establish file system formats and boot codes. Some of the file systems that Disktype recognizes include: FAT12/FAT16/FAT32, NTFS, HPFS, MFS, HFS, HFS Plus, ISO9660, UDF, ext2/ext3, Minix, ReiserFS, Reiser4, Linux romfs, Linux cramfs, Linux squashfs, UFS (some variations), SysV FS (some variations), JFS, XFS, Amiga, FS/FFS, Amiga SFS, Amiga PFS, BeOS BFS, QNX4 FS, 3DO CD-ROM FS, Xbox DVD file system, Veritas VxFS.
Author: Christoph Pfisterer
Source code: https://disktype.sourceforge.net/
Fatback - Fatback was designed to undelete files from FAT file systems.
Source Website: https://sourceforge.net/projects/biatchux
Author: Nicholas Harbour
The Sleuth Kit - The Sleuth Kit is a collection of command line tools for analyzing FAT, NTFS, EXT2FS and FFS file systems. It can also analyze DOS, BSD, Sun, and Mac partitions. The tool allows for the recovery and analysis of deleted content while allowing them to be sorted by file type, and viewed according to file activity in a timeline display.
Source: https://www.sleuthkit.org/sleuthkit/download.php
Author: Brian Carrier
The Coroner’s Toolkit (TCT) - TCT is a collection of programs that can be used to analyze the effects of a break-in attempt on a UNIX system.
Website/Source: https://www.porcupine.org/forensics/tct.html#source_code
Author: Dan Farmer & Wietse Venema
File AUdit Security Toolkit (FAUST) – This tool can be used to gather data after a break-in attempt has been discovered. Its goal is not to analyze data; instead it is a perl script that can be used to collect pieces of data, to be analyzed at a later date.
Source: https://security-labs.org/index.php3?page=faust
Author: Frederic Raynal
File - File guesses file types based on the file’s header and footer values.
Source: ftp://ftp.astron.com/pub/file/
Author: Christos Zoulas
Summary
Open source licenses allow talented people to make enhancements to programs so that they can perform even more specialized functions. Open source forensic hard drive recovery tools are particularly useful to forensic science professionals because they often need unique solutions to complete difficult and tedious forensic investigations.
While we introduced a number of hard drive and data recovery open source tools in this article, there are still many other freeware forensic tools that are available for media management and network and application analysis.
Image credits:
“Data Recovery - Forensic computer freeware tools.” pmsyyz
“Open source forensic hard drive recovery tools.” Tim Patterson
