Erased Graphic Image File Identification

Once a relevant file has been identified, e.g., in a child pornography case, using Graphics File Extractor software, then the first 40 bytes of the file should be used to search for the source data in the unallocated storage space of the subject computer storage device. This search can easily be done with NTI's HexSearch software. Once the relevant clusters have been identified, then they can manually be restored by the computer forensics specialist. We recommend the manual restoration of such files so the computer forensics specialist will have detailed knowledge of the process used and that the restoration will be exact. Automatic processes are not recommended because of the potentials of error in the reconstruction of the previously deleted graphics image file. When this is done, it makes for stronger expert witness testimony and it allows the jury to see how the process was done.