Deleted File Recovery for the Linux File System (Ext4): Finding the State-of-the-Art

In a digital forensics investigation, deleted file re-covery (DFR) can play a critical role. Apart from forensic investigation scenarios, DFR can also benefit a regular user if she wants to recover an important file that she has unintentionally deleted. Currently, Linux OS is quite popular and it uses Ext4 as its default file system. Prior researchers investigated DFR capability of digital forensics (DF) tools for Windows machines that use FAT and NTFS file systems. However, in most part, prior works did not investigate DFR capability of DF tools for Linux machines. In the current work, we attempt to fill in this gap by experimenting with the state-of-the-art DF tools to examine their DFR capability for Ext4. We found that only a few tools can recover or identify deleted files in Ext4 unless the deleted files contain special signatures. Furthermore, we have designed canonical file system images, and tested the DFR tools on these images to figure out what makes the tools succeed or fail. We report a gist of the results in the current paper.