Digital Forensics and Investigation Research Paper 2022

1
Digital Forensics and Investigation
Name of the Student
Name of the University
Author Note

2
Abstract
The main aim of this paper is demonstrating the process of data recovery to restore the
accidentally deleted blueprint files of DigiFirm organization. The blueprint files were stored in
an ordinary laptop with Windows operating system. Data recovery is important in several
situations to recover extremely crucial data. In this paper, the data recovery operation has been
demonstrated by using two third-party software and an in-built function of Windows 10. The
chosen third party software is the Disk Drill and Recuva where the used built-in function is the
file history. It has been assessed that both of the third-party software is quite effective for
restoring the deleted data files from a hard disk drive. The in-built function of the Windows 10 is
not so effective for like the other two third-party software.
Keywords: Recuva, Disk Drill, File History, DigiFirm.

3
Introduction
In the present time, computer systems have become an integral part of the daily life of
humans. Computers are used widely for performing various operations and storing important
data. Physical hardware parts are used for storing the local data. While some specific kind of data
is stored in a local storage device, it is quite possible that these data gets deleted accidentally. As
this kind of data does not hold any type of backups, deletion of these data can create an awful
situation.
In current scenario, DigiFirm is facing similar kind of situation as one of their disgruntled
employees has reformatted the hard disk in which DigiFirm was having some important
blueprint files. Thus, in this context, it is very much important for the DigiFirm to recover those
files. The computer in which the files were stored was an ordinary laptop which was running
Windows operating system. Thus, as a forensic investigator some important ways will be
elaborated through which those blueprint files can be restored. There are several ways which can
be used for retrieving these kinds of permanently deleted data (Mirkin, 2016). There are some
tools that are built in the Windows operating system which can be used for retrieving this type of
deleted files. Also, third party software systems are available for recovering the permanently
deleted files. In the following section, an outline is presented for demonstrating possible ways of
data retrieval.
Data Recovery Plan
In this section total, three procedures will be outlined for the retrieving the blueprint files
of DigiFirm that got deleted accidentally. Here, two third party software will be demonstrated for

4
retrieving the data from the hard disk and one Windows built-in program will be demonstrated.
The third-party software is the Disk Drill and Recuva.
Disk Drill
As a forensic investigator first a third-party data recovery software will be used to
recover the blueprint files of DigiFirm and that is Disk Drill, which is one of the prominent
software available in the market that can be used for performing the data recovery operation. The
developer of this software system is CleverFiles (Drill Disk, 2020).
To start Disk Drill, first, it needs to be installed in a compatible system. The ordinary
system of DigiFirm in which blueprint files were stored is compatible with this software. So,
installation will be done on this laptop. After successful installation, the user interface of Disk
Drill will be displayed, which is provided below.
The user interface of Disk Drill, which occurs after opening the application. Now, the
drive needs to be selected from which the data will be retrieved. There are list of available drives
from which the deleted data can be restored. In this case, it is assumed that the blueprint files
were stored in the disk drive (D:). So, disk drive (D:) will be selected for performing the data
recovery operation.