STTR Phase I: Next Generation Digital Data Recovery System

这个小型企业创新研究第一阶段的研究项目旨在研究下一代数字数据恢复技术。从损坏的数字设备恢复丢失的数据的问题经常出现在数字取证和数据恢复中。在许多先进的数字存储故障的情况下，目前可用的文件恢复技术的基础上磁盘存储信息失败。第一阶段项目的目标是进一步研究和完善重组技术，已经在理工学院开发，不依赖于磁盘信息，但基于文件内容本身的统计特性。为了建立一个商业上可行的工具，需要研究发现特定领域的技术，以确定类型的片段和额外的研究需要进行开发有效的/可扩展的算法，以恢复无数的文件类型。这项研究将需要引入专家系统，数据建模和组合优化技术。资金还将用于测试研究的可行性，通过在开发的数据恢复工具中实施研究。在第一阶段结束时，预计已经研究了足够的特定领域的恢复技术，以向现有的数字取证供应商销售数据恢复工具。在没有存储元信息将数据块连接在一起的情况下，从数字数据的比特和碎片中恢复信息的问题相当于将数百/数千个拼图混合在一起的问题。识别一段数据是否属于特定文件或文件类型的挑战令人望而生畏。此外，不仅要识别哪些片段属于哪个文件，还要识别数据的正确放置顺序，以重建文件。没有开展认真的工作来解决恢复支离破碎的数字数据的问题。在理工大学进行的初步研究不仅具有开创性，而且还证明了开发特定领域技术以识别数据片段类型和使用文件类型特定算法来构建文件的可行性。第一阶段的资金将用于进一步发展数据片段分类技术以及用于增强恢复的特定文件类型技术。这笔资金还将用于开发针对电子邮件、文字处理、数据库和多媒体文件的特定文件类型恢复算法。随着数字存储设备的使用和容量的激增，对更有效和更好的数据恢复技术的需求变得越来越明显。预计从这一提案中获得的资金可用于开发和传播一个专家系统，该系统可作为图书馆许可证发放给数字法证市场上的磁盘分析工具供应商。利用这些库，可以增强现有的工具来处理数字数据的恢复。数字取证市场将大大受益于额外的信息恢复，因为它对情报，执法和安全部门的需求至关重要。该项目的最终目标是开发一个独立的下一代恢复工具，利用第一阶段及以后研究的最新恢复技术。这样的工具，将满足数字取证和更广泛的数据恢复市场的需求。

This Small Business Innovation Research Phase I research project aimes to research next generation digital data recovery techniques. The problem of restoring lost data from a damaged digital device arises routinely in digital forensics and data recovery. In many advanced cases of digital storage failure currently available file recovery techniques based on disk storage information fail. The objective of the Phase I project is to further research and refine reassembly techniques, already developed in Polytechnic, that do not rely on disk information, but are based on the statistical properties of file contents themselves. In order to build a commercially viable tool, research is required for discovering domain specific techniques to identify the type of fragments and additional research needs to be conducted on developing efficient/scalable algorithms to recover a myriad of file types. This research will require introducing techniques from expert systems, data modelling, and combinatorial optimizations. Funding will also be used to test the viability of the research by implementing the research in a developed Data Recovery tool. At the end of Phase I it is anticipated to have researched enough domain specific recovery techniques to market the data recovery tool to existing digital forensic vendors. The problem of recovery of information from bits and pieces of digital data, in the absence of storage meta-information to tie the pieces together, is equivalent to the problem of having hundreds/thousands of jigsaw puzzles mixed into together. The challenge of identifying if a piece of data belongs to a specific file or file type is daunting. In addition, one must identify not only which pieces belong to which file but the correct order of placement of the data to reconstruct a file. There has been no serious work undertaken to tackle the problem of recovery of fragmented digital data. The preliminary research conducted at Polytechnic University has not only been groundbreaking, but also has demonstrated the viability of developing domain specific techniques to identify the type of data fragments and the use of file type specific algorithms to econstruct files. The funding from Phase I would be used to further data fragment classification techniques as well as file type specific techniques for enhanced recovery. The funding will also be used to develop file type specific recovery algorithms for email, word processing, database and multimedia files. With the surge in usage and capacities of digital storage devices, the need for more efficient and better techniques for data recovery are becoming more apparent. It is anticipated that funding obtained from this proposal can result in the development and dissemination of an expert system that can be licensed as libraries to the vendors of disk analysis tools in the Digital Forensic market. Utilizing these libraries, existing tools can be enhanced to handle the recovery of digital data. The digital forensic market will greatly benefit from the additional recovery of information as it can be crucial to the needs of the intelligence, law enforcement and security sectors. The ultimate goal of the project is to develop a stand-alone next generation recovery tool that utilizes the very latest recovery techniques researched in Phase I and beyond. Such a tool, would cater to the needs of the digital forensic and the broader data recovery market.