Investigating the Impact on Data Recovery in Computer Forensics

Defragmentation can potentially be employed as a tactic by perpetrators to conceal, misrepresent, or eliminate digital evidence. This study explores the effects of minor defragmentation, a potential method to conceal digital evidence, on recovering file system data in digital forensics. Our investigation sought to determine the influence of minor defragmentation on the effectiveness of data recovery and to identify methods that can augment the success rate post-defragmentation. We limited the scope of this study to defragmentation in Hard Disk Drives (HDDs), solid-state drives (SSDs), and USB drives. A mixed-method approach employs a literature review, case studies, and controlled experiments. Comparative analysis was used as the main data analysis technique to investigate its impact. Preliminary findings suggest that minor defragmentation hampers data recovery; however, certain strategies can augment success rates. These results can significantly influence the development of data recovery policies, particularly those of digital forensic analysts and law enforcement. The primary objective of this study is to bolster the efficiency and dependability of file system data recovery post-defragmentation while upholding ethical and legal standards.