Data investigation based on XFS file system metadata

Abstract

At present, as the amount of digitized information is increasing geometrically, the importance of digitized information as critical clues from the perspective of criminal investigation is also increasing. The importance of digital forensics has also magnified accordingly. As a fundamental technique of digital forensics, recovery of data deleted to conceal information is extremely important and needs to be studied. Although file system types and versions are diversified, sufficient studies have not been performed. The XFS file system was designed to process huge files, and thus it is expected to be applied in server systems. In this paper, we analyze the XFS file system using its structure and metadata information; then, we propose a technique to recover the deleted files through previous analysis results, and verify it through testing.

Ext4 and XFS File System Forensic Framework Based on TSK

“…To compensate for the aforementioned case, a file recovery method using the journal area of the XFS file system has been examined [8]. The recovery of a deleted file is achieved by leveraging the feature that information, such as the size and offset of the deleted file, remains in the journal area of the XFS file system.…”

“…However, the metadata analysis for file recovery is insufficient, and determining whether it has been normally extracted and recovered is difficult because hash value comparisons between the original and recovered files are not performed. Park et al [7] and Ahn et al [8] also proposed a file recovery method considering that the deleted inode is stored in the journal area, and the extent indicating the location of the actual data in the file is not deleted. However, the metadata analysis used for file recovery is insufficient.…”

“…In some studies, a file extraction and recovery method based on the open metadata of the Ext2/3 file system [4] and a deleted file recovery method based on the journal area of the Ext4 file system [5,6] have been suggested. Moreover, studies on the metadata analysis of the XFS file system and the recovery method of deleted files have been implemented [7][8][9]. Most of the studies on file extraction and recovery methods for file systems are performed based on metadata and journal areas; hence, an accurate analysis of the structure of the file system is required.…”