Forensic data recovery

Published: Last Edited:

This essay has been submitted by a student. This is not an example of the work written by our professional essay writers.


In this report the functionality of the data storage device and reliable sequence of store data in memory chip for using the advance technology and extendable security function for secure data. The new chip technology design for user friendly and use in flexible environment. In this system we will find how to make the data secure in solid memory design environment and adopting the new technology environment to make the external storage data device less power, more powerful and organizing the data more reliable with built-in tools. The objective of data store in external memory organization, input and output are fully TTL-compatible, common flash interface (CFI) and scalable command set, automatic write and erase algorithm, and ready to boost in sequence finally security block features of the flash memory. Describe the Forensic data recovery from flash memory, storage devices and functionality of the wireless sensor devices.


Flash memories are very popular and well organize storage system because it's very shock resistant, affordable and economically non volatile system in this age. The flash memory technology attracted the consumer with electronically and embedded system. This significant technology has very well organized reliable features which is very easy to use and attract the consumer in this new technology. Time to time the flash memory features and designing increasing specially capacity and competition increase in cost throughout in the market. The capacity of flash memory introduction very rapidly these days. A lot of companies in competition and try to introducing the maximum capacity flash memory could be considerable replacement of hard disk in many applications. Structure which is very popular and reliable into organization the data over disk must be over flash memory.

The flash memory embedded system is very user friendly environmental system. Flash memory file system is FAT32 in this system the data significantly design and recovery system has been embedded. The popularity of electronic embedded system in flash memory is exponential growth in the amount of digital world. For example the mobile phones now a days in built-in system in mobile system the digital camera is able to transfer the video taking picture, play, forward pictures, audio and video transmission these significant feature of embedded system of any electronic device related to the human behaviour and might became subject of a forensics investigation.

These day more and more feature are using in flash memory drive, either in connection with or as system embedded into drive application system. It's very most importation sound way of data acquisition is maintain or development to sustain and present evidence collection form the flash memory drive in a court of laws. But unluckily the flash memory storage system from the current forensic tools has great creating problem to getting essential data into the embedded application ad flash memory. Electronically by the forensic point of view the smart flash memory make the great forensic problem. When the forensic team try to getting data and analyse their content the current forensic tools examination of handling device such as mobile phone and PDA devices do not give full access the acquisition and full recovery of data. Which is place on these device some time situation is different mostly the deleted data which is might be very useful and helpful evidence about the offence perpetrated cannot be getting the only way to getting deleted data from the flash memory or other device to analyse and examine the lowest layer of data on this embedded system where the evidence may be expected.

In this system the flash memory storage management scheme is activated by the different characteristic of the underlying flash media in the flash memory files system including some evaluation tools, which tools write on bench marking or back up storage device, such HD bench for hard disk and FM bench for flash memory these tools only be considerable the backup of deleted file or data for further use and do not use the memory characteristic especially the flash memory management scheme which is called Flash Translation Layer (FTL). The performance and reliability if any storage device or flash memory is influence by the following these feature. It is very important feature in flash memory design and file system.

  • The underlying flash media.
  • The management scheme design
  • The access point or patterns which are generated by the application.

In the present age the flash memory is the most challengeable law enforcement especially for the forensic investigation team who are brake the wall when they come to getting damage data and analysis the data for evidence. In this modern technology age its is very important to give a great attention to these type device and understanding the tools, feature and characterize of getting damage data especially the safety about the Flash Translation Layer (FTL) level reachable this area for evidential data forensically.


Flash memory is designed non-volatile memory which is can electronically erased and reprogramming system. Flash memory come into pieces or type NOR flash and NAND flash. NOR introduced by Intel in 1988 and NAND introduced by Toshiba in 1989. Basically these electronic chip NOR and NAND is logically structures. These chips read byte by byte constantly. The data electronically hold in these chips by firmware the embedded software. These chips are use in mobile, PDA, USB flash disk, digital camera, multimedia device and phone camera use NAND flash memory technology to create compress data image. In this system we explain the base technology the physical and logical level.


To store the data in flash memory by physical mechanism use electronic charge into floating gate of transistor. This charge gradually stored the data for extended record of this time without using external power supply. The current physical structure in flash memory can be data retention between 10 to 100 years.

Flash memory store or write the data byte by bytes like Electronically Erasable Programmable Read Only Memory (EEPROM), but the data erased in block or layer system before rewrite on it. Erasing result in flash memory block filled into 1's in NAND memory flash system each block divided into page. For example 32 or 64 per erase block A, page usually multiply bye 512 bytes in size, just like the Hard Disk or Magnetic media bytes store in sector size these page are called spare area bytes use for store meta data. Some flash memory file system use the zones the zones is a group of blocks usually 256 to 1024. Basically the block and zones are logical concept no physical representation.


  1. B. Carrier, File System Forensic Analysis. Addison-Wesley 2005.
  2. Sandisk, "Sandisk flash memory cards - wear leveling", October 2003. [Online]. Available: WhitePapersAndBrochures/RS- MMC/WPaperWearLevelv1.0.pdf. [Accessed: November 29, 2006].
  3. Lin, et al. (2007). A NOR Emulation Strategy over NAND Flash Memory. Retrieved September 13, 2008,
  5. Nolan, R., O'Sullivan, C., & Waits, C. (2005). First Responders Guide to Computer Forensics. Retrieved June 9, 2008, from v 1.3.pdf
  8. D. Zeinalipour-Yazti, S. Lin, V. Kalogeraki, W. A. Najjar, D. Gunopulos: MicroHash: An Efficient Index Structure for Flash-Based Sensor Devices. FAST 05