IE Internet Information Forensics Technology in Unallocated Disk Space

This paper presents the main content of IE (Internet Explore) Internet record data, what fields are of forensic interest and what information the available tools can extract. It shows that remnants may still be found in unallocated disk space even the IE Internet record normal file data is deleted. This paper proposes a string pattern matching algorithm to find IE Internet record data in unallocated space based on known internal record structures. The system developed can recover deleted IE records and it may be an approach to obtain evidence in unallocated disk space.