Investigasi File Carving pada Media Penyimpanan Menggunakan Framework Computer Forensic Investigative Process

One of the uses of digital storage media in the digital era that is still popular today is the use of flash drives as a means of transferring data between computer devices. Flash disks are often used as evidence in digital investigation cases. The risk of losing data is one of the main problems that society often faces. Data loss occurs for various reasons, such as user error, device failure, malware attack, or criminal acts such as hacking. The file carving technique is used to recover lost or deleted files from digital storage media with Foremost software. However, with so many file types, it is sometimes difficult to choose which file types to recover and how to ensure the authenticity of the files. This study uses the Computer Forensic Investigative Process (CFIP) Framework on a flash drive, which is used as evidence in a criminal case. Foremost software is used to perform file carving techniques on flash drives. The results showed that the data acquisition process using DC3DD succeeded in producing digital evidence with a hash value that is identical to the original file. Foremost software successfully recovered various file types, such as 9 image files with jpg file type, 5 audio files with mp3 file type, and 5 document files with pdf file type. Foremost shows a high success rate, with file carving accuracy of 90% for image files, and 62.5% for audio files and documents. The average success rate of Foremost software in returning evidence is 73.08%.