UiTM CAWANGAN PERLIS

FACULTY OF SCIENCE COMPUTER AND MATHEMATICS (FSKM)

BACHELOR OF COMPUTER SCIENCE (HONS.) NETCENTRIC COMPUTING (CS251)

INTRODUCTION TO DIGITAL FORENSICS

ITT593

LAB 6

Prepared By:
MUHAMMAD DANISH GHAZI BIN MOHD FAKRURAZI
2020978989
RCS2515A

Prepared For:
SIR MUHAMAD ARIF HASHIM

Submission Date:
10th MAY 2021
 TABLE OF CONTENT

1.0 FIRST TASK .................................................................................................................................. 1

1.1 STEP 1: Installing Recuva .......................................................................................................... 1
1.2 STEP 2: Retrieve Deleted Files .................................................................................................. 3
2.0 SECOND TASK ............................................................................................................................. 8
2.1 STEP 1: Installing Eraser ............................................................................................................ 8
2.2 STEP 2: Deleting Files with Eraser Application ...................................................................... 10
3.0 SUMMARY .................................................................................................................................. 16
1.0 FIRST TASK
In the first task, we will be using Recuva application to recover deleted files.

1.1 STEP 1: Installing Recuva

1. First, download Recuva installer at https://www.piriform.com/recuva/download.

2. After downloading the installer, run it. Select English language and then press Next.

1
3. Accept all the default setting and click Install.

4. After successful installation, run Recuva.

2
1.2 STEP 2: Retrieve Deleted Files

1. First, download the “Welcome-White-Flowers.jpg” image and place it in the Desktop.

2. Delete the “Welcome-White-Flowers.jpg”. After that, empty the recycling bin.

3
3. Run the Recuva scan to retrieve the file.

4
4. After the scanning is done the following image should be displayed. We can filter so it
only displays results for pictures.

5
5. Find for the deleted “Welcome-White-Flower.jpg” file and recover it.

6. Choose the Desktop as the recovery destination.

6
7. After successfully recovering, the image file should be in the Desktop. Open the image to
see the picture.

7
2.0 SECOND TASK
In the second task, we will be using Eraser application to delete files without a trace.

2.1 STEP 1: Installing Eraser

1. First, download the Eraser installer at https://sourceforge.net/projects/eraser/

2. After the installer is done downloading, run the installer. Click on Next.

8
3. Choose typical installation.

4. After that, click on Install and it will begin installing Eraser into the computer.

9
 5. After completing installation, we can now run Eraser.

2.2 STEP 2: Deleting Files with Eraser Application

1. First, run Eraser application. It will display an empty Erase Schedule.

10
2. Select New Task from the Erase Schedule menu to display Task Properties window.

3. Ensure Run Manually is selected as the Task Type.

11
4. Click Add Data to display the Select Data menu.

5. Click Browse, and search for the “Welcome-White-Flowers.jpg” file. Choose the file and
after that click OK and then OK again.

12
13
6. Right click on the file and then choose “Run Now”. The file should now be deleted and
the status should be Completed.

14
7. After the status is now changed to Completed, close Eraser application. The “Welcome-
White-Flowers.jpg” file is now gone without a trace from Desktop. Run Recurva to check
validity. The Recurva scan is unsuccessful.

15
3.0 SUMMARY
In conclusion, I successfully learned how to recover deleted files using Recurva. Some of Recurva
application features include deep scanning tool, secure file overwriter, and formatted drive scanning.
Eraser is an application that lets us delete files without a trace. We do not have to delete files manually
with Eraser application.

16