Australian Digital Forensics Conference

Document Type

Conference Proceeding


School of Computer and Information Science, Edith Cowan University, Perth, Western Australia


There are many freeware based tools that can be downloaded from the World Wide Web. This paper reports the retrieval results of using these tools on digital images which have been deleted from Secure Digital (SD) cards. Since SD cards and USB flash drives are considered solid state technology, the tools selected are specifically for solid state drives. This research helps classify the selection of the most effective freeware tools that could be used to recover lost or deleted images. Further, it includes some of the issues that would face forensic examiners undertaking such investigations. The tools were tested using the Windows environment and did not require any specific forensics background in order to retrieve the images. The testing procedures included retrieval time and the state of the deleted image, viewable or damaged (corrupt). A review of tool functionality is given together with the most effective tools useful in retrieving images from deleted Secure Digital cards.


5th Australian Digital Forensics Conference, Edith Cowan University, Perth Western Australia, December 3rd 2007.