Tomb Raider - Automating Data Recovery and Digital Forensics

The speaker opens with the motivation: many drives that look dead have simple, fixable faults, and people often discard them without trying. Sending a private drive to a paid recovery service also raises privacy concerns, so a self-run workflow is appealing. The talk introduces Tomb Raider, a tool built to automate that workflow and developed mainly on Linux, and frames the work around a library analogy in which the file system is the catalog and the drive contents are the books.

The middle of the talk walks through the pipeline. The drive is first imaged with a tolerant copy utility that makes repeated passes over damaged areas, so the physical device is needed only once. The tool then tries to rebuild the file system with TestDisk and, if that fails or deleted data is wanted, carves files from unallocated space using signature-based recovery with PhotoRec. Carving produces many false positives, including system files and logs. To cut that noise, the tool flattens the directory tree into a single listing with sanitized names, hashes files with MD5 to remove duplicates, filters out known Windows system files using NSRL hash sets, and classifies files by extension and by content. Entropy scoring was tested but produced too many false positives, because encrypted and compressed formats also score high.

The speaker closes by noting that most failures are minor, that unknown drives should be connected to an isolated machine rather than a work desktop, and that the tool is a first step for overloaded forensic teams. Planned work includes rebuilding a cleaner file system with deduplication and better filtering. The talk also covers finding discarded drives, through online marketplaces, hackerspaces and e-waste, and it shows the kinds of personal data that surviving drives can still reveal.