Perbandingan Hasil Recovery File terhadap Penghapusan File menggunakan Perintah Sdelete dan Shift+Delete: indonesia - Rosi Rahmadi Syahputra; Prayudi, Yudi (UII, 2025)
The recovery of deleted data is an important aspect of forensic digital investigations, especially in identifying relevant evidence. However, deletion techniques such as the Sdelete command implement the Department of Defense (DoD) 5220.22-M standard which can permanently delete so that the process of recovering digital evidence from storage media will be difficult, while deletion using Shift+Delete only removes file references without overwriting the data, thus allowing data recovery with file carving techniques. This study uses a static forensic method, where the data in the flash drive has been deleted and acquired using FTK Imager so as to produce an imaging file to maintain the integrity of the evidence. After that, the imaging file is processed using file carving tools. This study aims to compare the results of deleted recovery using the Sdelete command and the Shift + Delete key combination and assess based on the highest percentage of the results of three file carving tools, namely Autopsy, Axiom Magnet, and Photore. The results of the study show that files deleted using Sdelete cannot be recovered by the three tools, both in terms of artifact findings and the suitability of hash values, according to Microsoft's claims. In contrast, files that have been deleted using the Shift + Delete key combination can still be recovered with varying success. PhotoRec has the highest recovery rate (90%), followed by Autopsy (88%) and Axiom Magnet (60%). In terms of hash value suitability, PhotoRec reaches 80%, while Autopsy 76% and Axiom Magnet 50%. These findings confirm that Sdelete is effective in permanently deleting data, while the Shift + Delete combination still allows for recovery with varying success rates. The author hopes that this research can be a new knowledge for digital forensic investigators in terms of selecting the most suitable file carving tools for digital evidence recovery.