RECUPERACIÓN DE INFORMACIÓN EN DISCOS DUROS ELECTROMECÁNICOS A NIVEL FÍSICO Y LÓGICO PARA SU ANÁLISIS FORENSE INFORMÁTICO

Abstract

During an investigation of Computer Forensic in an electromechanical hard disk drive, it could happen that the hard disk has a physical or logical damage, turning the analysis for searching evidence becomes impossible, a Data Recovery process will be required. The Data Recovery on damaged hard disk drive and the Computer Forensic must have its own methodology, since both cases the experts handle with information, which it is the target of the analysis. Due the absence of a standard methodology for this process and because there are only “best practices”, which helps to an adequate and earlier recovery, the purpose of this research is to provide an applicable methodology which objective is to recover as much reliable data as possible. In order to establish the methodology is necessary to know the causes and consequences that arises the damages, these effects determine each stage of the methodology using the correspondent decision taking, and then apply the suggested solution by this methodology. Finding those causes that arise the damages in electromechanical hard disk drives, it is necessary to understand the logical and physical structure as their operation. In order to establish the classification of logical damages, attacks on logical structure were tested. For physical classification and methodology, it was used groups of hard disk drives of 2.5” and 3.5” with different features. The results of applying the methodology in a group of electromechanical hard disk drives are displayed using a model of multivariate regression analysis, which shows the impact that the methodology caused on the recovery data rate.