Forensic storage carving using AI

About the Project

In computer forensics, investigators need to be able to analyse the contents of storage devices. Such devices generally store information in blocks, and the arrangement of blocks in a certain order is the thing which represents a files. However, if the information about how each block connects together is lost, then it can almost impossible to piece the blocks back together again in order to reform all the data objects.

In storage drives, each block is arranged into file objects using the filesystem metadata. If this metadata is lost or deleted, recovery is challenging. Such recovery might be useful during a forensic examination of a drive where some of the data was deleted. Some work has been done in this area of forensics, but the processes are mechanical and the effectiveness limited to only certain cases.

Blocks themselves can contain any sort of data, so categorising each block is a good first step. In a file system this could for instance be differentiating pdf blocks from jpeg blocks. Some algorithms exist already in this area, but these are largely algorithmic and lack high precision. Joining different blocks of the same time together to form the original file or memory object would also be a useful step, and this is certainly an area with many opportunities to explore.

Many current approaches rely on the hope that a single data object will most likely be available in contiguous blocks. Such unfragmented sets of data blocks is relatively easy to extract. However many filesystems now utilise non-contiguous areas regularly, instead using tree-based version branching for files which leads to greater degrees of fragmentation and of block reuse between file versions. In addition, the continuous switch to solid-state storage devices can further confound the process, where such memory blocks are highly fragmented in the storage layer, and where blocks may be more easily recovered than the mapping tables in the storage manager.

This PhD proposes to examine block-based data found in a variety of storage systems, and develop systems to analyse data blocks and understand how such blocks relate to each other through the use of artificial intelligence. Such techniques could be neural networks or based on data mining approaches. In block-storage systems the resulting methodologies should allow whole files to be recreated without referencing the accompanying metadata.

Academic qualifications

First degree with at least a 2:1 classification in Computing.

English language requirement

IELTS score must be at least 6.5 (with not less than 6.0 in each of the four components). Other, equivalent qualifications will be accepted. Full details of the University’s policy are available online.

Essential attributes:

• Fundamental knowledge of Operating Systems, Digital Forensics and Artificial Intelligence
• Strong motivation
• Keen interest in the area

Desirable attributes:

• Good written and oral communication skills
• Good time management

APPLICATION CHECKLIST

• Completed application form
• CV
• 2 academic references, using the Postgraduate Educational Reference Form (download)
• Research project outline of 2 pages (list of references excluded). The outline may provide details about
  1. Background and motivation of the project. The motivation, explaining the importance of the project, should be supported also by relevant literature. You can also discuss the applications you expect for the project results.
  2. Research questions or objectives.
  3. Methodology: types of data to be used, approach to data collection, and data analysis methods.
  4. List of references.

The outline must be created solely by the applicant. Supervisors can only offer general discussions about the project idea without providing any additional support.

• Statement no longer than 1 page describing your motivations and fit with the project.
• Evidence of proficiency in English (if appropriate)

To be considered, the application must use

• the advertised title as project title

For informal enquiries about this PhD project, please contact g.russell@napier.ac.uk

Application link: https://evision.napier.ac.uk/si/sits.urd/run/siw_sso.go?ElOlarlItFiG37xnH5PRRBvv3d563wLdwX4JfhYskMa3bJWTuc

PhD Start Date: October 2026

Funding Notes

International applicants should note that visa application costs and the NHS health surcharge are additional costs to be taken into consideration, and successful applicants will need to cover these expenses themselves.

References

Dipo Dunsin, Mohamed C. Ghanem, Karim Ouazzane, Vassil Vassilev, A comprehensive analysis of the role of artificial intelligence and machine learning in modern digital forensics and incident response, Forensic Science International: Digital Investigation,Volume 48, 2024.
https://www.forensicfocus.com/articles/a-survey-on-data-carving-in-digital-forensics/