STTR Phase I: Next Generation Digital Data Recovery System

这项小型企业创新研究第一阶段研究项目旨在研究下一代数字数据恢复技术。从损坏的数字设备中恢复丢失数据的问题在数字取证和数据恢复中经常出现。在许多数字存储故障的高级案例中，现有的基于磁盘存储信息的文件恢复技术失效了。第一阶段项目的目标是进一步研究和改进已经在理工学院开发的重组技术，这些技术不依赖于磁盘信息，而是基于文件内容本身的统计特性。为了建立一个商业上可行的工具，需要研究发现特定领域的技术来识别碎片的类型，并且需要进行额外的研究，开发高效/可扩展的算法来恢复无数的文件类型。这项研究将需要引入专家系统、数据建模和组合优化等技术。拨款亦会用于测试研究的可行性，方法是在已开发的数据恢复工具中实施研究。在第一阶段结束时，预计将研究足够的特定领域的恢复技术，以向现有的数字取证供应商推销数据恢复工具。在没有存储元信息的情况下，从数字数据的碎片中恢复信息的问题相当于将成百上千的拼图混合在一起的问题。识别一段数据是否属于特定文件或文件类型是一项艰巨的挑战。此外，人们不仅必须确定哪些片段属于哪个文件，而且必须确定数据的正确放置顺序以重建文件。没有开展认真的工作来解决恢复碎片化数字数据的问题。在理工大学进行的初步研究不仅具有开创性，而且还证明了开发特定领域技术来识别数据片段类型和使用特定文件类型算法来构建文件的可行性。第一阶段的资金将用于进一步发展数据片段分类技术以及增强恢复的特定文件类型技术。这笔资金还将用于为电子邮件、文字处理、数据库和多媒体文件开发特定文件类型的恢复算法。随着数字存储设备的使用和容量的激增，对更有效和更好的数据恢复技术的需求变得更加明显。预计从该提案中获得的资金可用于开发和传播专家系统，该系统可作为库授权给数字法医市场上的磁盘分析工具供应商。利用这些库，可以增强现有工具来处理数字数据的恢复。数字取证市场将大大受益于信息的额外恢复，因为它对情报、执法和安全部门的需求至关重要。该项目的最终目标是开发一种独立的下一代采油工具，利用第一阶段及以后研究的最新采油技术。这样一个工具，将满足数字取证和更广泛的数据恢复市场的需求。

This Small Business Innovation Research Phase I research project aimes to research next generation digital data recovery techniques. The problem of restoring lost data from a damaged digital device arises routinely in digital forensics and data recovery. In many advanced cases of digital storage failure currently available file recovery techniques based on disk storage information fail. The objective of the Phase I project is to further research and refine reassembly techniques, already developed in Polytechnic, that do not rely on disk information, but are based on the statistical properties of file contents themselves. In order to build a commercially viable tool, research is required for discovering domain specific techniques to identify the type of fragments and additional research needs to be conducted on developing efficient/scalable algorithms to recover a myriad of file types. This research will require introducing techniques from expert systems, data modelling, and combinatorial optimizations. Funding will also be used to test the viability of the research by implementing the research in a developed Data Recovery tool. At the end of Phase I it is anticipated to have researched enough domain specific recovery techniques to market the data recovery tool to existing digital forensic vendors. The problem of recovery of information from bits and pieces of digital data, in the absence of storage meta-information to tie the pieces together, is equivalent to the problem of having hundreds/thousands of jigsaw puzzles mixed into together. The challenge of identifying if a piece of data belongs to a specific file or file type is daunting. In addition, one must identify not only which pieces belong to which file but the correct order of placement of the data to reconstruct a file. There has been no serious work undertaken to tackle the problem of recovery of fragmented digital data. The preliminary research conducted at Polytechnic University has not only been groundbreaking, but also has demonstrated the viability of developing domain specific techniques to identify the type of data fragments and the use of file type specific algorithms to econstruct files. The funding from Phase I would be used to further data fragment classification techniques as well as file type specific techniques for enhanced recovery. The funding will also be used to develop file type specific recovery algorithms for email, word processing, database and multimedia files. With the surge in usage and capacities of digital storage devices, the need for more efficient and better techniques for data recovery are becoming more apparent. It is anticipated that funding obtained from this proposal can result in the development and dissemination of an expert system that can be licensed as libraries to the vendors of disk analysis tools in the Digital Forensic market. Utilizing these libraries, existing tools can be enhanced to handle the recovery of digital data. The digital forensic market will greatly benefit from the additional recovery of information as it can be crucial to the needs of the intelligence, law enforcement and security sectors. The ultimate goal of the project is to develop a stand-alone next generation recovery tool that utilizes the very latest recovery techniques researched in Phase I and beyond. Such a tool, would cater to the needs of the digital forensic and the broader data recovery market.