Evaluasi Kinerja File Carving Berbasis NIST pada Media Flashdisk Menggunakan Autopsy, Recuva, dan PhotoRec

Abstract

This study aims to analyze the performance of file carving software in digital forensic investigations using the National Institute of Standards and Technology (NIST) methodology. The NIST framework is applied due to its systematic and well-structured stages, namely Collection, Examination, Analysis, and Reporting, which support reliable digital forensic processes. A flash drive was used as digital evidence and examined using three file carving tools: Autopsy, Recuva, and PhotoRec. Two testing scenarios were conducted, including file deletion and quick format. The evaluation parameters consisted of processing speed, the number of recovered files, and file integrity based on MD5 hash value matching.The results show that in the deletion scenario, all software tools successfully recovered the test files with 100% accuracy, while Recuva demonstrated the fastest recovery time. In the quick format scenario, Autopsy was unable to perform file carving, whereas Recuva and PhotoRec successfully recovered data. PhotoRec outperformed Recuva in terms of processing speed and recovery accuracy based on MD5 hash verification. These findings indicate that the effectiveness of file carving tools depends on the case scenario rather than a single superior tool. Therefore, selecting an appropriate digital forensic tool is essential to ensure accurate and effective file carving investigations.