Recovering deleted or hidden data is among most important duties of forensicsinvestigators. Extensive utilisation of smartphones as subject, objects ortools of crime made them an important part of residual forensics. This chapterinvestigates the effectiveness of mobile forensic data recovery tools inrecovering evidences from a Samsung Galaxy S2 i9100 Android phone. We seek todetermine the amount of data that could be recovered using Phone image carver,Access data FTK, Foremost, Diskdigger, and Recover My File forensic tools. Thefindings reflected the difference between recovery capacities of studied toolsshowing their suitability in their specialised contexts only.
展开▼
