Recovering Multimedia Files from a Memory Image

Suzen A. A., Tasdelen K.

JOURNAL OF POLYTECHNIC-POLITEKNIK DERGISI, vol.21, no.3, pp.731-737, 2018 (ESCI) identifier


The widespread use of digital technologies increases the size of data stored in digital media. The increased amount of stored data also brings along data security risks. One of the most important risks in personal data security is the unauthorized or accidental data deletion. There are file recovery and carving software for recovering deleted files from the storage devices. Files must be loaded into RAM to be used in the operating system. These files are stored in RAM for a certain amount of time by the memory manager. Therefore, a file opened or deleted by the user in the operating system can be found in the RAM. File carving techniques must be applied to RAM to access these files.