Digital disk forensics occupies a foundational stratum within the broader discipline of digital forensic science, constituting the systematic acquisition, preservation, and analytical interrogation of data artifacts residing on persistent storage media. The present synthesis undertakes an exhaustive review of evidence extraction and analysis methodologies as applied to digital disk environments, with particular emphasis on three structural pillars: (I) the mathematical and architectural underpinnings of file system forensics, (II) the deterministic and probabilistic algorithms governing data recovery and artifact reconstruction, and (III) the epistemological tensions inherent in forensic validity, reproducibility, and judicial admissibility. The discipline has undergone substantial metamorphosis since its inception in law enforcement contexts during the late 1980s, evolving from rudimentary hexadecimal inspection into a multi-layered, tool-agnostic analytical science. Contemporary practitioners must navigate a complex taxonomic landscape encompassing live acquisition versus dead-box imaging, journaled versus nonjournaled file systems, wear-leveling obfuscation on solid-state media, and the latent variables introduced by anti-forensic instrumentation. This review draws on peer-reviewed literature, established forensic frameworks (NIST SP 800-86, ISO/IEC 27037:2012), and computational models to synthesize a rigorous, architecturally grounded understanding of the field's state through 2024. The principal finding is that evidence extraction fidelity is asymptotically bounded by the irreversible entropy introduced at the storage hardware layer a constraint that no purely software-based analytical pipeline can fully overcome.
Parla Bellisan (Mon,) studied this question.