# Innovative Learning in a Digital Forensics Laboratory: Tools and Techniques for Data Recovery
## 2 Related Work
### Data Analysis Tools  
Of the tools available for forensic investigation, some are applied to specific tasks, while others are used for complete studies (i.e., acquisition, authentication, and analysis) [17; 18]. The main tools used for data analysis are as follows:  
* Oxygen Forensic Detective (OFD). This is used for logical and physical extractions, including data analysis and visualization in forensic image formats and in different types of electronic devices. OFD generates judicially admissible reports directly from the application and offers extensive support for Android devices and brute-force decryption of 7-Zip files. The main drawbacks are that it is an expensive and complex software [19]. * OpenText EnCase Forensic (EnCase). This software, which performs memory acquisition, data extraction, forensic report generation, and password recovery, is widely recognized by judicial departments and forensic research agencies. It supports a large  
Figure 1: Data extraction methods, ranked 1 to 5, reflecting levels of destructiveness in terms of a sliding scale based on time, knowledge, complexity, and alteration [11]. Figure 2: Commercial hardware platforms used for JTAG extraction: **(A)** Octoplus; **(B)** Riff Box; **(C)** Ort JTAG Tool; **(D)** Easy JTAG Box; and **(E)** Advanced Turbo Flasher (ATF) Box. number of mobile device and tablet models, and its latest version features EnCase Media Analyzer, which uses artificial intelligence and machine learning to identify and categorize the content of forensic images based on datasets. The generated reports employ a format admitted in judicial processes and also preserve the chain of custody for all the examined sources [20]. * Cellebrite Inseyets, Cellebrite UFED, and Cellebrite Digital Collector. These enable the recovery of deleted data, information decryption, and password extraction. Supporting a wide range of devices, including Android and Apple mobile devices, they can unlock devices and acquire logical and physical data. Inseyets integrates Universal Forensics Extraction Device (UFED) services with autonomy and quick\(-\)view technologies, which enable electronic device content to be viewed before creating forensic images, while novel capabilities allow for the simultaneous automation of multiple processes [21; 22; 23]. * Passware Kit Forensic (PKF). This enables the acquisition and processing of disk images and password recovery through brute\(-\)force, dictionary, and pattern attacks. PKF, useful when encrypted or locked data need to be accessed without using more invasive techniques, includes a resource manager that maximizes the performance of the analysis machine and an improved bootable memory imager mode, which creates memory images during computer startup. PKF does not include report generation suitable for judicial procedures, and support for mobile device processing is only included in the Ultimate edition [24; 25]. * Belkasoft X Forensic (BXF). This enables the acquisition and authentication of NAND memory images through various analytical tasks (e.g., timelines and advanced searches). BXF, which supports numerous types of electronic devices and dump formats, can examine messaging applications, web browsing data, email inboxes, documents, images, video and audio files, file systems, and mobile applications. Processing times can be reduced through task automation and the use of specific search approaches. Additionally, BXF provides bit\(-\)level analysis through its HEX viewer and file system window, and BelkaCarving can recover and validate deleted, hidden, or corrupted information in databases [26]. * SANS Investigative Forensic Toolkit (SIFT). Available as a downloadable virtual machine, SIFT, a workstation designed for forensic analysis, uses key functionalities that include the Rekall Framework, Sleuth Kit, and Volatility. It offers extensive support for file systems and disk images, and comprehensive step\(-\)by\(-\)step documentation is available online [27]. * Sleuth Kit and Autopsy.