Static forensic analysis of file carving on SSDs uses NIST and ACPO method

Khoirul Anam Dahlan; Anton Yudhana; Herman Yuliansyah

doi:10.35784/iapgos.7223

PDF

Published: Jun 30, 2026

DOI: https://doi.org/10.35784/iapgos.7223

Issue Vol. 16 No. 2 (2026)

Performance evaluation of optimized deep learning model with Multilayered Max-Norm Regularization (MMNR) technique for brain tumour classification in MRI multi-modal images
Mulackal Chandran Binish, Vinu Thomas

5-14
Stroke detection from brain CT-images and its volume visualization
Rithu James, Appukuttan Harsha, Liza Annie Joseph

15-21
Adaptive filtering for noise reduction in photoplethysmography signals
Hicham Loumissi, Adil Barra, Najat Messaoudi, Othmane El Badlaoui, Bahloul Bensassi, Hicham Medromi

22-25
Evaluation of informational diagnostic criteria and severity biomarkers using a discrimination model in patients with COVID-19
Gryhoriy Gradil, Oleg Avrunin, Kateryna Yurko, Natalia Shushlyapina, Yuliia Kalashnyk-Vakulenko, Mariia Shostatska, Aigul Iskakova

26-31
Signal amplifiers in optical communication systems
Nurzhigit Smailov, Nurlybek Turar, Akezhan Sabibolda

32-36
Analysis of underwater communication systems based on hybrid Li-Fi technology
Nurzhigit Smailov, Aizhan Urazgaliyeva, Akezhan Sabibolda

37-43
Applying Box-Behnken design to research voice control automatic lighting systems
Oleksandr Burban, Mykola Polishchuk, Anatolii Tkachuk, Serhii Kostiuchko, Liliia Polishchuk, Valentyna Tkachuk

44-49
Paddy fields detection on Sentinel-2 satellite images using EfficientDet model
Suvarna Vani Koneru, Kamal Epuri, Bhuvanesh Kakumanu, Ram Dinesh Aduri

50-55
Models for assessing accuracy and reliability of fibre-optic gyroscope-based navigation systems
Maral Abulkhanova, Nurzhigit Smailov, Yerlan Tashtay, Gulbakhar Yussupova, Anar Khabay, Beibarys Sekenov, Akezhan Sabibolda

56-60
Aggregation of multimodal log and metric streams for neuro-fuzzy anomaly detection in computer systems
Andrii Mishchenko, Oleksii Shushura, Alona Kolomiiets, Andrii Donets, Olena Kosaruk

61-67
Static forensic analysis of file carving on SSDs uses NIST and ACPO method
Khoirul Anam Dahlan, Anton Yudhana, Herman Yuliansyah

68-75
Fuzzy logic-based security risk assessment in wireless sensor networks of Industrial IoT
Olena Semenova, Natalia Kryvinska, Olha Voitsekhovska, Andrii Dzhus, Volodymyr Martyniuk

76-83
Multicriteria optimisation of information protection system configuration based on the NSGA-II algorithm
Valeryi Lakhno, Myroslav Lakhno, Alona Desiatko, Bohdan Bebeshko

84-90
Method of structural-block coding of tuple transformant video images
Volodymyr Barannik, Dmytro Uzlov, Yevhenii Yelisieiev, Valeriy Barannik, Nina Petrukha, Mykhailo Babenko, Dmitry Barannik, Vladyslav Kostromytskyi, Oleh Kompaniiets, Artem Bychenko

91-101
Analysis of the increase in model forecasting accuracy after data normalization
Vladyslav Pylypenko, Vladyslava Skidan, Antonina Volivach

102-106
Optimizing parameters for 4D hyperchaotic system using Walrus Optimizer Algorithm
Karam Adel Abed, Omar Saber Qasim, Saad Fawzi Al-Azzawi

107-112
Iron coagulation optimization during water treatment using artificial intelligence tools
Andrii Safonyk, Ivan Tarhonii, Oleksandr Naumchuk, Vladyslav Danchenkov, Roman Zaichuk

113-117
Optimisation of the generating capacity of droop-based DGs integrated into an isolated AC microgrid using metaheuristic algorithms to minimise power losses
Tuan-Ho Le, Tham X. Nguyen, Robert Lis, Muhammad Jamshed Abbass

118-125
Chemical composition, structural and electrical properties of CdZnTeSe thick polycrystalline films
Yaroslav Znamenshchykov, Oleksii Lisovenko, Mykola Khvyshchun, Anatoliy Opanasyuk

126-130
Substantiation of a new method for separation of bulk materials on a vibro-friction separator
Mykola Bakum, Serhii Kharchenko, Anatolii Mykhailov, Mykola Krekot, Taras Shchur, Oleg Dzhidzhora

131-138
Software-based performance evaluation and forecasting of web applications using machine learning models
Liubov Oleshchenko

139-144
Comparative analysis of Java unit and integration testing tools: JUnit, TestNG and Spock
Dawid Grabek, Jan Gryta, Mariusz Dzieńkowski

145-151
Application of UML in the development process of computer games
Lyudmila Samchuk, Yuliia Povstiana, Yaroslav Tymoshchuk

152-155
Design of digital cooking assistant system with modern voice generative AI model
Robert Banasiak, Zdzisława Rowińska, Wojciech Szczucki, Dawid Jantosz, Łukasz Rembowski

156-161
Deep learning architectures for multiclass clothing recognition as the semantic core of automated virtual try-on systems
Roman Chekhmestruk, Olena Voitsekhovska, Svitlana Kyrylashchuk

162-172
Knowledge model "Tags about batches and containers" of the ERP system "PlasmIS" with the possibility of self-improvement using local llm models
Oleh Bisikalo, Valerii Starzhynskyi, Tetiana Molodetska, Nelia Burlaka

173-178
Paradigms of information technology impact on economic education
Artem Yurchenko, Inna Kharchenko, Volodymyr Shamonia, Vladyslav Bespalyi, Serhii Bohoslavskyi, Olena Semenikhina

179-186

Authors

Khoirul Anam Dahlan

khoirulanamdhln@gmail.com

Institut Teknologi Statistika dan Bisnis Muhammadiyah Semarang, Indonesia

https://orcid.org/0009-0001-3535-965X

Anton Yudhana

eyudhana@mti.uad.ac.id

Universitas Ahmad Dahlan, Indonesia

Herman Yuliansyah

herman.yuliansyah@tif.uad.ac.id

Universitas Ahmad Dahlan, Indonesia

Abstract

Solid State Drive (SSD) recovery is challenging due to a lower success rate than traditional storage devices. Latest file carving techniques, such as those used in Foremost and Autopsy software, offer a solution for recovering lost files, whether intentionally or unintentionally deleted, on SSDs. The study compares approaches to recovering deleted data from SSDs. NIST method provides accountable reporting for legal proceedings and ACPO framework guides the recovery process through planning, capture, analysis, and presentation stages. In an experiment using a 120 GB Geniune SATA SSD and a 512 GB Eaget mSATA SSD with NTFS, 88 lost files were recovered. Foremost successfully restored 46 files (52.27%), while Autopsy recovered 81 files (92,05%), with success measured by matching MD5 hash values and ensuring files were accessible. Despite not reaching 100% recovery as seen in HDDs, the findings highlight the promise of Autopsy in digital forensics and legal evidence. The recovery process was conducted using Ubuntu and Windows OS, indicating the potential for improved SSD recovery.

Keywords:

system recovery, image forensics, digital storage, solid state drives, flash memories, digital information

References

[1] Barr-Smith, F., Farrant, T., Leonard-Lagarde, B., Rigby, D., Rigby, S., & Sibley-Calder, F. (2021). Dead Man’s Switch: Forensic Autopsy of the Nintendo Switch. Forensic Science International: Digital Investigation, 36, 301110. https://doi.org/10.1016/j.fsidi.2021.301110

[2] Brown, D., Walker, T. O., Blanco, J. A., Ives, R. W., Ngo, H. T., Shey, J., & Rakvic, R. (2021). Detecting firmware modification on solid state drives via current draw analysis. Computers & Security, 102, 102149. https://doi.org/10.1016/j.cose.2020.102149

[3] Chamkha, A., Veismoradi, A., Ghalambaz, M., & Talebizadehsardari, P. (2020). Phase change heat transfer in an L-shape heatsink occupied with paraffin-copper metal foam. Applied Thermal Engineering, 177, 115493. https://doi.org/10.1016/j.applthermaleng.2020.115493

[4] Domingues, P., Andrade, L. M., & Frade, M. (2021). Microsoft’s Your Phone environment from a digital forensic perspective. Forensic Science International: Digital Investigation, 38, 301177. https://doi.org/10.1016/j.fsidi.2021.301177

[5] Domingues, P., Frade, M., Andrade, L. M., & Silva, J. V. (2019). Digital forensic artifacts of the Your Phone application in Windows 10. Digital Investigation, 30, 32–42. https://doi.org/10.1016/j.diin.2019.06.003

[6] Dunsin, D., Ghanem, M. C., Ouazzane, K., & Vassilev, V. (2024). A comprehensive analysis of the role of artificial intelligence and machine learning in modern digital forensics and incident response. Forensic Science International: Digital Investigation, 48, 301675. https://doi.org/10.1016/j.fsidi.2023.301675

[7] Genç, A., Doğan, H., Turhan, L., Kocakuşak, A., & Helhel, S. (2024). Investigation of the radiated emission of honeycomb structured aluminum foam/cellular heatsinks at 1–10 GHz. Materials Chemistry and Physics, 324, 129614. https://doi.org/10.1016/j.matchemphys.2024.129614

[8] Gnani, E., & Baccarani, G. (2024). Memory devices—Non-volatile memories. In Encyclopedia of Condensed Matter Physics (pp. 552–575). Elsevier. https://doi.org/10.1016/B978-0-323-90800-9.00236-5

[9] Gonzales, L., LaTourrette, N., & Doherty, B. (2025). AKF: A modern synthesis framework for building datasets in digital forensics. Forensic Science International: Digital Investigation, 55, 302004. https://doi.org/10.1016/j.fsidi.2025.302004

[10] Gruber, J., Hargreaves, C. J., & Freiling, F. C. (2023). Contamination of digital evidence: Understanding an underexposed risk. Forensic Science International: Digital Investigation, 44, 301501. https://doi.org/10.1016/j.fsidi.2023.301501

[11] Horsman, G. (2021). Digital evidence and the crime scene. Science & Justice, 61(6), 761–770. https://doi.org/10.1016/j.scijus.2021.10.003

[12] Kim, D., Kim, J., Choi, K., Han, H., Ryu, M., & Kang, S. (2024). Dynamic zone redistribution for key-value stores on zoned namespaces SSDs. Journal of Systems Architecture, 152, 103159. https://doi.org/10.1016/j.sysarc.2024.103159

[13] Kim, S., Jung, J., Kang, H., Yoon, Y., Cho, S., Park, M., & Han, S. (2025). An effective automotive forensic technique utilizing various logs of Android-based In-vehicle infotainment systems. Forensic Science International: Digital Investigation, 55, 301990. https://doi.org/10.1016/j.fsidi.2025.301990

[14] Kumar, U., & Venkaiah, V. Ch. (2022). An Efficient Message Authentication Code Based on Modified MD5-384 Bits Hash Function and Quasigroup: International Journal of Cloud Applications and Computing, 12(1), 1–27. https://doi.org/10.4018/IJCAC.308275

[15] Li, X., Kim, M., Lee, S., Zhai, Z., & Kim, J. (2025). Program context-assisted address translation for high-capacity SSDs. Future Generation Computer Systems, 162, 107483. https://doi.org/10.1016/j.future.2024.107483

[16] Liu, J., Wang, T., Chen, X., Li, C., Shen, Z., & Zhang, Z. (2024). H 2 -RAID: Improving the reliability of SSD RAID with unified SSD and HDD hybrid architecture. Microprocessors and Microsystems, 105, 104993. https://doi.org/10.1016/j.micpro.2023.104993

[17] Luo, L., Li, S., Lv, Y., & Shi, L. (2023). Performance and reliability optimization for high-density flash-based hybrid SSDs. Journal of Systems Architecture, 136, 102830. https://doi.org/10.1016/j.sysarc.2023.102830

[18] Miller, C. M. (2023). A survey of prosecutors and investigators using digital evidence: A starting point. Forensic Science International: Synergy, 6, 100296. https://doi.org/10.1016/j.fsisyn.2022.100296

[19] Mohammed Ali, A., & Kadhim Farhan, A. (2020). A Novel Improvement With an Effective Expansion to Enhance the MD5 Hash Function for Verification of a Secure E-Document. IEEE Access, 8, 80290–80304. https://doi.org/10.1109/ACCESS.2020.2989050

[20] Park, A., Ryu, H., Park, W., & Jeong, D. (2023). Forensic investigation framework for cryptocurrency wallet in the end device. Computers & Security, 133, 103392. https://doi.org/10.1016/j.cose.2023.103392

[21] Park, J., Kim, S., Cho, T., & Kang, M. (2025). Optimization of read operation for low power consumption in 3D NAND flash memory. Microelectronic Engineering, 298, 112324. https://doi.org/10.1016/j.mee.2025.112324

[22] Ryu, J., Noh, D. K., & Kang, K. (2024). FlashPage: A read cache for low-latency SSDs in web proxy servers. Engineering Science and Technology, an International Journal, 51, 101639. https://doi.org/10.1016/j.jestch.2024.101639

[23] Santikellur, P., Buddhanoy, M., Sakib, S., Ray, B., & Chakraborty, R. S. (2023). A shared page-aware machine learning assisted method for predicting and improving multi-level cell NAND flash memory life expectancy. Microelectronics Reliability, 140, 114867. https://doi.org/10.1016/j.microrel.2022.114867

[24] Sokol, P., Antoni, Ľ., Krídlo, O., Marková, E., Kováčová, K., & Krajči, S. (2023). Formal concept analysis approach to understand digital evidence relationships. International Journal of Approximate Reasoning, 159, 108940. https://doi.org/10.1016/j.ijar.2023.108940

[25] Solodov, D., & Solodov, I. (2021). Data recovery in a case of fire-damaged Hard Disk Drives and Solid-State Drives. Forensic Science International: Reports, 3, 100199. https://doi.org/10.1016/j.fsir.2021.100199

[26] Stoykova, R. (2023). The right to a fair trial as a conceptual framework for digital evidence rules in criminal investigations. Computer Law & Security Review, 49, 105801. https://doi.org/10.1016/j.clsr.2023.105801

[27] Tok, Y. C., Zheng, D. Y., & Chattopadhyay, S. (2025). A Smart City Infrastructure ontology for threats, cybercrime, and digital forensic investigation. Forensic Science International: Digital Investigation, 52, 301883. https://doi.org/10.1016/j.fsidi.2025.301883

[28] Wickramasekara, A., Breitinger, F., & Scanlon, M. (2025). Exploring the potential of large language models for improving digital forensic investigation efficiency. Forensic Science International: Digital Investigation, 52, 301859. https://doi.org/10.1016/j.fsidi.2024.301859

[29] Xi, J., Siegel, M., Labudde, D., & Spranger, M. (2025). Towards a joint semantic analysis in mobile forensics environments. Forensic Science International: Digital Investigation, 52, 301846. https://doi.org/10.1016/j.fsidi.2024.301846

[30] Yun, W., Kang, J., Lee, S., & Park, J. (2025). Digital forensic approaches to Intel and AMD firmware RAID systems. Forensic Science International: Digital Investigation, 54, 301971. https://doi.org/10.1016/j.fsidi.2025.301971

Dahlan, K. A., Yudhana, A., & Yuliansyah, H. (2026). Static forensic analysis of file carving on SSDs uses NIST and ACPO method. Informatyka, Automatyka, Pomiary W Gospodarce I Ochronie Środowiska, 16(2), 68–75. https://doi.org/10.35784/iapgos.7223

Static forensic analysis of file carving on SSDs uses NIST and ACPO method

Issue Vol. 16 No. 2 (2026)

Archives

Authors

Abstract

Keywords:

References

License

Article Sidebar

Issue Vol. 16 No. 2 (2026)

Archives

Main Article Content

Authors

Abstract

Keywords:

References

Article Details

License