2

I am presently working as a summer intern.

My first objective is, given a collection of files, recover and identify the file types present in it.

To download sample pseudo-forensics data I have been using: Digital Corpora

To recover files I have been using 'The Sleuthkit' but this does not seem to do the work as I always get error messages regarding the format of the data being used.

It would be great to get suggestions/links to tutorials or software which help in recovering data.

I am also looking forward to links to download psuedo forensic data similar to the one above.

Specifically, I would like to recover all data that are in text formats(word,pdf,emails,html... etc) then unify it into one single file in text format and then use natural language processing to determine places the person was associated with. I have some ideas with respect the natural language processing aspect of the problem but need help with respect to data recovery. How best to do this task.

closed as off-topic by Xander, Steve, Eric G, Ayrx, Adi May 21 '14 at 13:39

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • What you are asking is FAR too broad for us to answer. You could analyze the file collection using shell scripts, for instance. – schroeder May 20 '14 at 20:16
  • @schroeder could you please guide me towards tutorials or links. Basically given a hard drive i want to recover files to analyze later. Thank you – Manu May 20 '14 at 21:01
  • Your problem is too undefined to provide tutorials. What do you mean by 'recover'? Are you just indexing the files or do you want some other kind of processing? What kind of 'analysis' do you expect to do 'later'? There is just too many ways you could look at this problem. Refine the problem, then the answers will come. – schroeder May 20 '14 at 21:08
  • @schroeder I would like to recover all data that are in text formats(word,pdf,email,html... etc) then unify it into one single file in text format and then use natural language processing to determine places the person was associated with. How best to do this task. Thank you – Manu May 20 '14 at 21:19
  • 1
    @MatthewPeters could you please give me some suggestions regarding books to buy to learn the basics. Thank you – Manu May 22 '14 at 5:04
0

This is quite a broad question but here is one way you could possibly do it, you could use autopsy over the full sleuthkit as it is really just a wrapper for the sleuth kit but a heck of a lot easier to use.

Next index your target disk (assuming it is coming from a hard disk) and you can then regex query your index from the autopsy using things like .doc or whatever.

Not the answer you're looking for? Browse other questions tagged or ask your own question.