A Highly Recoverable and Efficient Filesystem

Abstract

Data recovery is a significant problem that presents a real challenge to forensics investigators today. File carvers have traditionally helped mitigate these difficulties. However, two issues still present significant challenges -1) Prior knowledge of file types is required for building file carvers, and 2) fragmentation prevents file carvers from successful recovery. In previous research, we proposed a framework for recovering deleted files without prior knowledge of file types and with the existence of fragmentation. In this paper, we introduce the design and a functioning implementation of our system by modifying an exFat filesystem running on top of FUSE. Evaluation of the overhead of our filesystem shows only a 5% decrease in performance in write operations when compared to an unmodified exFat filesystem, and almost identical read measurements. Our system also shows significantly better recovery rates in the presence of fragmentation when compared to two selected file carvers.

APEX: Adaptive Ext4 File System for Enhanced Data Recoverability in Edge Devices

“…We tested it for Gandcrab and it was not able to identify it. [19] AFS [15] Hanson [20] Breeuwsma et al [21] Alhussein et al [22] Stoica et al [13] Huang et al [23] Alhussein et al [24] Baek et al [25] Lee et al [26] Continella et al [14] APEX [this work] Table I A COMPARISON OF RELATED WORKS WITH OURS Another technique by Huang et al [23] has been proposed for recovering encrypted data from flash drives. They provide a ransomware tolerant SSD which has firmware-level recovery systems, but the main drawback of their approach is that they keep multiple copies of data and hence need significantly more space than required.…”

“…Techniques that involve tagging of file blocks with some identifiers have been used by Alhussein et al in [22] and [24], where frameworks like FUSE have been used for development of forensic based file-systems. They provide forensic file identifiers at cluster-level file allocation to provide information needed for file types to be recovered after deletion.…”

Comparison of data recovery techniques on master file table between Aho-Corasick and logical data recovery based on efficiency

“…Data recovery algorithms play an effective role during digital investigative procedures so the data on computer hardware has become one of the most important criminal evidence sought by investigators, in the United States alone, the FBI reported over 300,000 complaints of online criminal activity in 2011 [1][2][3][4][5], costing nearly $500,000,000. Data recovery depends primarily on the file system used to store and format data in different volumes (new technology file system (NTFS), file allocation table (FAT), extension (EXT), ANDROID) [6][7][8][9][10][11].…”