During an investigation into a suspected data exfiltration i…
During an investigation into a suspected data exfiltration incident at a financial services firm, forensic analyst Maria Chen is examining a Dell PowerEdge server that was recently decommissioned. The IT department had performed a quick format on the 2TB hard drive before disposal, believing it would be repurposed for a different project. However, the Security Operations Center flagged unusual encrypted file transfers from this server to an external IP address in the days before decommissioning. Maria creates a forensic image using FTK Imager and begins her analysis. While examining the disk with Autopsy, she notices the Master File Table (MFT) shows no entries for image files, and directory structures have been wiped. However, intelligence suggests the threat actor may have staged sensitive financial documents as JPEG files in a hidden directory before exfiltration. Maria decides to use Sleuth Kit’s bulk_extractor on the unallocated clusters of the disk image. She configures the tool to search for specific byte patterns: FF D8 FF E0 through FF D8 FF E1 at potential file boundaries, and FF D9 as termination markers. After processing 847 GB of unallocated space, the tool successfully reconstructs 63 JPEG files containing screenshots of customer account data, wire transfer confirmations, and proprietary trading algorithms—despite the complete absence of file system directory entries, allocation tables, or inode structures. Question: Which forensic recovery technique did Maria primarily employ to extract these image files from the formatted disk?