A file undelete with Aho-Corasick algorithm in file recovery

Abstract

In this research, a file undelete method is proposed by which the file recovery system retrieved the file metadata through a parsing process from the master file table (MFT) attributes. Using the Aho-Corasick algorithm, the process is then continued with a filtering process in which keywords are matched with file names. The result obtained shows that the proposed method is able to perform recovery of files that has been deleted from the file system. The experiment is performed four times with various file condition which had been overwritten 0%, 18.98%, 32.21% and 59.77% from their original size. The rate of the average file recovery success is 87.50% and the average time required is 0.32 second for string matching on file names.