Digital forensic approach for file recovery in Unix systems: Research of data recovery on Unix file system

Jo, Wooyeon; Chang, Hyunsoo; Shon, Taeshik

doi:10.1109/itnec.2016.7560423

Cited by 5 publications

(2 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In summary, both domestic and foreign countries have achieved certain results in research and application of data recovery techniques based on the YAFFS2 file system. However, there are still some problems and challenges, such as how to improve recovery efficiency and how to handle the recovery of large files [4] . The research content of this paper is focused on the study of data recovery techniques under the file system, through the research and analysis of the YAFFS2 file system to understand its characteristics, and then design and implement the recovery of various versions of data in the file system.…”

Section: Research Status At Home and Abroadmentioning

confidence: 99%

Research on data recovery technology based on YAFFS2 file system's hash linked list and time series analysis

Zhu

2024

Fourth International Conference on Telecommunications, Optics, and Computer Science (TOCS 2023)

View full text Add to dashboard Cite

With the widespread use of smartphones and embedded devices, data security issues have become increasingly prominent. Among them, the file system, as a key part of storing and managing data, pl ays a crucial role in its stability and security. YAFFS2 file system has become one of the most commonly used file systems in these devices due to its excellent performance and stability. However, data loss can occur due to various reasons such as accidental deletion or hardware failures. Therefore, researching and developing an effective data recovery technique for YAFFS2 file system is of great significance to ensure the safety of user data. Firstly, we conducted an in-depth analysis of the structure and characteristics of the YAFFS2 file system. YAFFS2 is a file system specifically designed for NAND Flash, which adopts a log structure to effectively handle random writes to NAND Flash. In addition, YAFFS2 also has self-repair and garbage collection functions, further improving its stability and reliability. Next, we introduced common data recovery methods. These methods mainly include file header-based recovery, content-based recovery, and metadata-based recovery. However, when dealing with complex data recovery tasks, these methods often suffer from low efficiency or poor recovery results. To address these issues, we proposed a multi-version data recovery algorithm based on hash chaining and a time series construction method based on timestamps. Both method s are designed based on the characteristics of the YAFFS2 file system. The multi-version data recovery algorithm based on hash chaining can effectively handle multiple versions of files, improving the accuracy of data recovery. On the other hand, the time series construction method based on timestamps can effectively handle the continuity of data, improving the efficiency of data recovery.

show abstract

Section: Research Status At Home and Abroadmentioning

confidence: 99%

Research on data recovery technology based on YAFFS2 file system's hash linked list and time series analysis

Zhu

2024

Fourth International Conference on Telecommunications, Optics, and Computer Science (TOCS 2023)

View full text Add to dashboard Cite

show abstract

“…The carving technique is what is meant. This technique helps in finding hidden or deleted files from digital media or with the data acquisition technique that has been discussed by Jo et al (2016) regarding data acquisition using forensic tools, namely Autopsy. This technique is very helpful for a forensic expert to collect data or evidence [21].…”

Section: Introductionmentioning

confidence: 99%

Data Recovery Comparative Analysis using Open-based Forensic Tools Source on Linux

Abdillah¹,

Prayudi²

2022

IJACSA

View full text Add to dashboard Cite

Data recovery is one of the forensic techniques used to recover data that has been lost or deleted. Data recovery is carried out if there is a condition where the data that has been owned is deleted or damaged. If the data has been lost or deleted or even tampered with, then a forensic expert has several ways to restore data that has been lost or damaged. One of them is to use a complete data recovery method using forensic tools, namely, TSK Recover, FTK Imager, Foremost Recover, and Testdisk Recover. Unfortunately, tools such as FTK imager and TSK recover have a weakness, namely that some damaged or corrupted data files cannot be restored in their entirety; they can only be recovered but not be opened. This study uses a tool comparison method approach using foremost recover and Testdisk recover. It's just that this method cannot be used using the graphic user interface (GUI) but using the CLI (Command Line) in the LINUX operating system. And the files that have been recovered will be fully recovered.

show abstract

Disk Forensics of VxWorks File Systems for Aircraft Security

McKeon,

Roberge

2023

IEEE Can. J. Electr. Comput. Eng.

View full text Add to dashboard Cite

Digital forensic approach for file recovery in Unix systems: Research of data recovery on Unix file system

Cited by 5 publications

References 2 publications

Research on data recovery technology based on YAFFS2 file system's hash linked list and time series analysis

Research on data recovery technology based on YAFFS2 file system's hash linked list and time series analysis

Data Recovery Comparative Analysis using Open-based Forensic Tools Source on Linux

Disk Forensics of VxWorks File Systems for Aircraft Security

Contact Info

Product

Resources

About