Running head: IMAGE RECOVERY1

Image Recovery

Lorenze Salas

Professor Aaron Jones

IMAGE RECOVERY 2

Image Recovery

To recover a deleted image from a USB Drive, I

used Autopsy 4.17.0, which an open-source

forensic tool “that normally been used by cyber

forensic resources and law enforcement to determine

the evidence that happens within the computer and

presented it at the court for further action” (Ariff,

2020). I right clicked the USB drive and clicked on

the format tab, then clicked start. When that happens,

it erases everything on the USB drive.

I opened Autopsy 4.17.0, the latest version of the software, then fill out the case information

and putting the file on a separate folder.

After filling out the case

information, I selected local

disk as my data source and

configure the ingest modules.

Then I must wait for the ingest

modules and data source to be

analyzed.
IMAGE RECOVERY 3

When the results are finished, I clicked View -> File Types -> By Extension -> Images.

Then it shows me the deleted images that were deleted back a few years ago when still

owned the USB drive. To recover it, I simple right clicked the images that I wanted to

export. Hit extract files and save it on the export

folder.

Opening the CFR105 USB Drive Export folder, it shows that the images has been recovered.
IMAGE RECOVERY 4

References

Ariff, W. (2020, June 1). Autopsy Forensic Tools Review. https://threatninja.net/autopsy-forensic-tools-

review/#:~:text=An%20autopsy%20is%20a%20tool%20that%20normally%20been,presented

%20it%20at%20the%20court%20for%20further%20action