안드로이드 운영체제의 Ext4 파일 시스템에서 삭제 파일 카빙 기법
File Carving for Ext4 File System on Android OS
0
조회
0
다운로드
7
인용
0
참고문헌
키워드
초록
많은 리눅스 운영체제와 안드로이드 운영체제에서 Ext4 파일 시스템을 사용하고 있어 디지털 포렌식 관점에서Ext4 파일 시스템 상의 삭제 파일 복구가 현안이 되고 있다. 본 논문은 Ext4 파일 시스템에서 파일의 할당, 삭제 시특징을 분석함으로써 삭제된 파일에 대한 복구 방법을 제시하였다. 특히 안드로이드 운영체제의 파일 할당 정책을 바탕으로 비 할당 영역에 조각나 있는 삭제된 파일에 대한 복구 방법을 제시한다.
Abstract
A lot of OS(Operating Systems) such as Linux and Android selected Ext4 as the official file system. Therefore, a recovery of deleted file from Ext4 is becoming a pending issue. In this paper, we suggest how to recover the deleted file by analyzing the entire structure of Ext4 file system, the study of metadata area, the distinct feature when file is assigned and deleted. Particularly, we focus on studying the features of file which is assigned in Ext4 file system in Android OS and also suggest the method to recover the deleted file that is fragmented from the un-allocated area.
참고문헌 (23)
- Kevin D. Fairbanks, "An analysis of Ext4 for digital forensics", Digital Investigation, 9, pp.118~130 (2012)
- Dohyun Kim, "Forensic Analysis of Android Phone using Ext4 File System Journal Log", Lecture Notes in Electrical Engineering, 164, pp.435~446 (2012)
- Val Henson, "Reducing fsck time for ext2 file systems", Proceeding of the Linux Symposium, 1 (2006)
- Philip Craiger, "Recovering Digital Evidence from Linux Systems", IFIP The International Federation for Information Processing, 194, pp.233~244 (2005)
- "SANS Information, Network, Computer Security Training, Research, Resources"[URL]
- "EXT3 File Recovery via Indirect Blocks"[URL]
- Gregorio Narváez, "Taking advantage of Ext3 journaling file system in a forensic investigation" (2007), SANS Institute Reading Room
- "ext3grep"[URL]
- "extcarve"[URL]
- "giis-ext4"[URL]
- "Stellar Phoenix Linux Data Recovery"[URL]
- "EaseUS"[URL]
- Brian Carrier, "File Sysetm Forensic Analysis" (2005), Addison Wesley Professional
- Aneesh Kumar K.V, "Ext4 block and inode allocator improvements", Proceeding of the Linux Symposium (2008)
- Avantika Mathur, "The new ext4 filesystem: current status and future plans", Proceedings of the Linux Symposium (2007)
- Theodore, "Speeding up file system checks in ext4" (2009), The Linux Foundation
- "Guidance Software"[URL]
- "SQLite Database File Format"[URL]
- "SQLite Database File Format2"[URL]
- Simson L. Garfinkel, "GarCarving contiguous and fragmented files with fast object validation", Digital Investigation, 4, pp.S2~S12 (2007)
- Golden Richard III, "In-Place File Carving", Digital Forensics III : IFIP The International Federation for Information Processing, 242, pp.217~230 (2007)
- Jungheum Park, "Forensic analysis techniques for fragmented flash memory pages in smartphones", Digital Investigation, 9, pp.109~118 (2012)
- Sangjun Jeon, "An Efficient Method of Extracting Strings from Unfixed-Form Data", Lecture Notes in Electrical Engineering, 164, pp.425~434 (2012)