Digital Forensics Report: Data Recovery Analysis for EMTS Project

This digital forensics report investigates potential intellectual property theft from Exotic Mountain Tour Services (EMTS) by a contract employee, Bob Aspen. The report focuses on recovering deleted files from a USB drive using forensic tools like Remo Recovery, Winhex, and stenography. Remo Recovery is used to retrieve a corrupted PDF file, Winhex recovers deleted images, and stenography extracts hidden text from an image. The analysis details the steps taken with each tool, including screenshots, to demonstrate the data recovery process. The report concludes that these tools are effective for data recovery and enhance an organization's reliability and scalability in data management. Desklib provides access to past papers and solved assignments for students seeking similar resources.

DIGITAL FORENSICS

Abstract
This project aims to create the digital forensic report for Exotic Mountain Tour Service.
This report is needs to investigate the probable intellectual property stolen by the Bob Aspen
who is working as a contract employee of the EMTS. The EMTS organization has completed
analysis and marketing process on the customer service provided by the Superior Bicycle. The
EMTS current IT infrastructure is does not provide the effective data recovery. So, it needs to
analysis the digital forensic tools to provide the effective data recovery for an organization.
2

Table of Contents
1. Introduction..............................................................................................................................3
1.1 Background.......................................................................................................................3
1.2 Scope.................................................................................................................................3
1.3 Forensic Tools...................................................................................................................3
2. Analysis....................................................................................................................................4
2.1 Remo Recovery tool..........................................................................................................4
2.2 Winhex tool.......................................................................................................................4
2.3 Stenography tool...............................................................................................................6
3. Findings....................................................................................................................................6
3.1 Recover the PDF file using Remo recovery......................................................................6
3.2 Recover the deleted image in the usb Using Winhex.....................................................10
3.3 Recover the hidden text in Image using Stenography tool.............................................18
4. Conclusion..............................................................................................................................21
References......................................................................................................................................22
3

1. Introduction
1.1 Background
This project is to investigate the probable intellectual property which is stolen by the Bob
Aspen who is working as contract employee of the Exotic Mountain Tour services (EMTS). This
organization has completed a very expensive marketing process and analysis on the customer
services and it provided by the superior bicycle LLC Company. This organization has one plan to
do an efficient and effective advertisement for a joint product deal of superior bicycles with their
tour services. The EMTS is used to ensure the promoting effort material under the disclosure
concurrence with superior bicycle. The EMTS chief found a USB drive on the work area was
allocated to Bob aspen and this work decide if the drive you some intriguing the data he
accumulated from the web server executive. This organization has web based email activity
through the organization system and distinguishes the suspicious connection for a organization
channels.
1.2 Scope
Main scope of this project is to create the digital forensic report for provided scenarios. We
will recover the deleted file which ahs suspicious data that are related to the case files from USB.
To recovery a deleted files by using the appropriate digital forensic tools. In provided case study,
we are going to use the Winhex forensic tools to recover the deleted image from USB. The Remo
recovery tool is used to recover the pdf file and stenography tool is used to recovering the hidden
text in the image ("22 Popular Computer Forensics Tools [Updated for 2018]", 2018). So, these
recovery techniques are needs to be analysis before finding the evidence for the provided
scenario.
1.3 Forensic Tools
The forensic tools used in the provided case study. They are listed in below.
 Remo Recovery
 Winhex
 Stenography
4

2. Analysis
2.1 Remo Recovery tool
The Remo recovery tool is used to provide the complete data recovery solutions for an
organization and it also provide the outstanding platform for data recovery in organization. It
capable for retrieving the use lost or deleted data or information and it can be recovering the
wide variety of data on windows (AG, 2018). Generally, this organization faces the issues of lost
documents, files and images and these are recovered and a threat of permanently deletion of data
remains. This tool is needs to regain all the user deleted data are recovered quickly. This tool has
various features and these are used for an organization. The features are listed below.
 It recovering the data from USB, file systems such as ExtFAT, NTFS, FAT32 and
FAT16. These file systems are supported by the Remo recovery tool.
 It easily recovers the deleted and lost data from windows.
 It recovering the files form corrupt partitions, deleted partition and formatted
partitions that is RAID0, RAID 5 and RAIN 1 array.
 It has ability to utilize and recognize the all types of files including the audio, video,
office files, photos and other file types.
 It recovers the all kinds of hard drives like SCSI, IDE and SATA. It has high
capable of recovering the data from memory cards.
 It has smart and strong recovery modules to provide the effective data recovery
compared other tools ("Comparison of hex editors", 2018).
 It helps to undelete the files and folders deleted using the shift + delete.
 This tool is effectively recovering the images of format PSD, JPEG, TIF, BMP,
PNG and etc.
 It has save recovery session options are used to allow used to save the present
recovery session and it provide the efficient data recovery for an organization.
 The recovered data can be saved as desired location of user system.
2.2 Winhex tool
Winhex forensic tools are a universe hex editor and it useful in organization because it is
very helpful for realm of data recovery, computer forensic and low level data editing ("Digital
forensics", 2018). It recovery and editing the following aspects like floppy disks, hard disks,
5

computer RAM, computer flash, memory sticks, any kind of file, DVD, CR-ROM and all drive
types. It support the NTFS, FAT32, FAT16 and FAT12 file system. It is very useful for editing
and inspects the recovered data files, lost data files and all kinds of files fro, the hard drive with
corrupt file system. It is generally very fast. So, many organizations use this tool to provide the
effective data recovery process for an organization. The Winhex tool has various features such as
 Disk cloning
 Support file of any size
 Extensive program help
 Import all the clip board formats
 Editing data structures using templates
 Examine and look at records.
 Join and split records.
 Comparing and analyzing the files
 Convert between the Intel hex, ASCII, binary and more.
 It use the various data recovery techniques
 It has disk editor for floppy disks, CD-ROM, smart media, floppy disks, hard disks
and more.
 It splitting and concatenating and files
 Recapture information.
 Encode records
 Diving and unifying the even and odd words and bytes
 It has scripting and programming interfaces
 Wipe drives.
 Make hashes and checksums.
 It also has the random number generator, instant window switching and printing.
It has centre an all inclusive hexadecimal supervisor and it especially supportive in the
domain of information recuperation, PC legal science, IT security and low level preparing
("Remo Recover 4.0.0.65 Crack + License key Full Version Download", 2018). It utilize and
investigate the wide ranges of documents, erased records and lost information from USB and
hard drives with degenerate document frameworks from advanced camera cards.
6

2.3 Stenography tool
The steganography tool is used to allow user to embed the hidden data inside a carrier file
like audio, video, images and other documents. It modifies the original file to detect the threat. IT
manipulate the data is bitwise manipulation to generate the cyphertext. It tool is used to ensure
the robustness against the modern forensic methods line steganlysis. It also done the data
whitening process, encoding process and stream based cryptography process ("Remo Recover –
Recover data / files from Windows, Mac and Android OS", 2018).
3. Findings
3.1 Recover the PDF file using Remo recovery
The Remo recovery tool is used to recover the PDF file. It also used to recovery the
corrupted PDF and it changes the PDF footer and Header to provide the effective data recovery
from USB ("WinHex", 2018). If any users deleted the organization important PDF files and it
recovered by using the Remo recovery tool because it is most common tool to recovery the
corrupted and Normal PDF file from the USB. It is user friendly tool. So, most of the
organization uses this tool to recovering the deleted and corrupted data. The below project pdf
file is to be corrupted and deleted. So it needs to recover by using Remo recovery tool. It is
shown below.
7

The below screenshots is shows the deleted project PDF file ("WinHex - Free download", 2018).
8

So, it needs to be recovered by using the Remo recovery tool. First, open the Remo recovery
tool. The home of the Remo recovery tool is shown below.
To recovery the deleted PDF file by click the recover files and it display the recover lost file and
deleted files. It is shown below.
9

After, we select the recover deleted file and select the USB. Then, click the next arrow. It is
shown below ("Software for Computer Forensics, Data Recovery, and IT Security", 2018).
10

Finally, it Display the deleted PDF file. It is shown below.
Then, click the recovered PDF to save the PDF file for correct folder.
3.2 Recover the deleted image in the usb Using Winhex
The Winhex recovery tool is used to recovery deleted image from USB. This is very
popular data recovery tool and it very useful this organization. It is used to provide the efficient
11

and effective data recovery operations for an organization. It is easily recovery the deleted
images form USB. It also recovers the corrupted images. This process is shown below. The
below screenshots is display the corrupted images and it needs to be recovered by using the
Winhex recovery tool (AG, 2018).
The below screen shot is used to display the corrupted image.
12