A paradigm shift in digital forensics

In the digital age, the recovery of deleted data is a key challenge in digital forensics. With the constant increase in data volumes and storage methods, conventional methods are reaching their limits. This is where the Carve-DL research project comes in: an AI-based solution that can recover files that are difficult to reconstruct by the use of learning algorithms to sustainably improve the efficiency and accuracy of digital data reconstruction.

Traditionally, forensic examiners use standardized, often manual processes to recover deleted data. While these methods rely on fixed file signatures or file system metadata, Carve-DL breaks new ground. Using advanced deep learning technologies, in particular Swin Transformer V2 and ResNet, the software can not only recover complete files but also reconstruct highly fragmented data. This enables precise recovery even in cases where traditional techniques prove to be insufficient.

Carve-DL is aimed at digital forensics specialists who need to reconstruct deleted or fragmented data. One example is the recovery of automatically deleted cache data from websites that is relevant to an investigation. Manipulated or deliberately destroyed digital evidence can also be reconstructed using AI.

Case study: The Disappearance of the Mona Lisa

The accompanying video uses a fictional crime story to show how Carve-DL can reconstruct deleted image data. In the fictional scenario, the Mona Lisa is stolen and all digital traces of the crime are deleted. The video illustrates how Carve-DL reconstructs the original record of the stolen painting from fragmented memory data of the thief, thus enabling forensic analysis.

This example is intended to illustrate the practical benefits of the developed AI methods: the system can identify, classify, group and correctly arrange deleted image fragments—a process that can also be crucial for real digital evidence. The whole video can be found in the attachment to this news.

Technological milestones

Since the project kick-off in November 2022 significant progress has been made. The AI-Workflow has continuously been optimized to tackle the complex demands of digital forensics and data reconstruction competently:

1. Classification model: New classification models to identify file types in raw data, which improve the recovery process.
2. Verification model: A specialized verification model to reliably reconstruct image fragments.
3. Clustering techniques: Deep learning-based clustering techniques that efficiently identify groups of file fragments that belong together.
4. Reordering model: An advanced fragment reordering model that already correctly assembles 95% of the reconstructed image fragments.

The use of Swin Transformer V2 and ResNet has significantly increased the efficiency of the system. In particular, Supportive Clustering with Contrastive Learning (SCCL) has increased clustering accuracy to around 85%.

Challenges and innovative solutions

One of the biggest challenges during the project was the indeterminate number and nature of the fragments to be reconstructed. Carve-DL solved this problem by processing this uncertainty early in the pipeline through iterative clustering.

Another problem was the scalable and efficient reordering of the fragments. To address these issues, a combination of digital signal processing and low-rank approximation (LoRA) was integrated in order to use computing resources more efficiently.

Potential beyond forensics

In addition to police investigations, Carve-DL shows promising potential for other fields of application:

• data recovery in industry, for example to restore lost research data.
• Digital restoration and archiving, for example in the preservation of historical documents.
• Cyber security, to analyze manipulation or targeted data deletion.

With the Carve-DL project due to come to an end in October 2025, the research team draws a positive balance. The developed technologies show that AI-based data reconstruction can revolutionize digital forensics. Through innovative methods, it is possible to recover deleted or fragmented data with unprecedented precision.

Provided by
Deutsches Forschungszentrum für Künstliche Intelligenz GmbH, DFKI