Timestamp prefix carving for filesystem metadata extraction

Porter, Kyle; Nordvik, Rune; Toolan, Fergus; Axelsson, Stefán

doi:10.1016/j.fsidi.2021.301266

Cited by 5 publications

(5 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Teknik disk carving atau file carving bisa digunakan untuk proses recovery data yang telah dihapus permanen. Disc carving dan file caring adalah kemampuan untuk mendapatkan kembali file yang telah dihapus atau disembunyikan pada sebuah medium penyimpanan dengan atau tanpa file sistem (Raad Ali et al, 2018;Sari and Mohamad, 2020;Porter et al, 2021). Pada penelitian ini akan menggunakan tool hetman partition recovery yang sudah mendukung recovory dengan teknik disk carving.…”

Section: Pendahuluanunclassified

Teknik Disk Carving untuk Recovery Solid State Drive Volume ReFS dan NTFS dengan Fitur TRIM

Muhardinata,

Luthfi,

Ramadhani

2023

jiip

View full text Add to dashboard Cite

Resilient File Sistem (ReFS) dan New Technology File System (NTFS) memiliki informasi metadata yang berbeda, sehingga membuat proses pemulihan data yang telah dihapus secara permanen menjadi sulit. Ini disebabkan oleh fakta bahwa alat analisis forensik yang umum digunakan bergantung pada tabel master file sistem yang tidak dapat dibaca pada volume ReFS. Perbedaan dalam metadata ini juga memengaruhi fitur TRIM pada Solid State Drive (SSD). Penelitian ini bertujuan untuk menguji pengaruh Teknik Disk Carving pada SSD dengan volume ReFS dan NTFS. Kami menggunakan metode Forensika Langsung yang mengikuti Standar Nasional Indonesia (SNI) 27037:2014. Metode ini dipilih karena memungkinkan kami untuk mengambil lebih banyak data dengan menggunakan alat seperti FTKImager. Kami mengumpulkan 34 sampel data dari volume ReFS dan 34 sampel data dari volume NTFS pada SSD dengan TRIM dinonaktifkan dan diaktifkan. Hasil penelitian menunjukkan bahwa data yang berhasil dipulihkan pada SSD dengan TRIM aktif adalah sekitar 9% pada volume NTFS, sementara pada volume ReFS data yang berhasil dipulihkan adalah 0%. Namun, pada SSD dengan TRIM dinonaktifkan semua data berhasil dipulihkan pada volume NTFS, sementara pada volume ReFS sekitar 74% data berhasil dipulihkan. Kesimpulannya setelah penelitian ini, data pada sistem file ReFS dengan TRIM dinonaktifkan dapat dibaca kembali melalui teknik disk carving. Sistem file juga memengaruhi SSD dengan fitur TRIM yang diaktifkan. Setelah pemulihan data pada volume ReFS dengan TRIM aktif, data akan muncul dalam bentuk folder tanpa nilai HASH, sementara pada volume NTFS dengan TRIM aktif, data tetap utuh tetapi sebagian besar memiliki nilai kunci HASH yang berbeda dari file aslinya.

show abstract

Section: Pendahuluanunclassified

Teknik Disk Carving untuk Recovery Solid State Drive Volume ReFS dan NTFS dengan Fitur TRIM

Muhardinata,

Luthfi,

Ramadhani

2023

jiip

View full text Add to dashboard Cite

show abstract

“…In this study, Nordvik performed tests to recover $MFT entries of NTFS and inodes of Ext4 using the proposed recovery method. Porter [21] improved Nordvik's research by recovering metadata using a continuous pattern of similar timestamps with the same prefix. This allowed the recovery accuracy to be improved by recovering additional metadata not found in Nordvik's original approach.…”

Section: Recovery Of Timestampmentioning

confidence: 99%

Forensic Recovery of File System Metadata for Digital Forensic Investigation

Lee

Hwang

2022

IEEE Access

View full text Add to dashboard Cite

File system forensics is one of the most important elements in digital forensic investigations. To date, various file system forensic methods, such as analysis of tree structure and the recovery of deleted file data, have been studied. Among these file system forensic methods, the recovery of file system metadata is a key technique that makes digital forensic investigations possible by recovering metadata when it is not possible to obtain metadata in a regular manner because the file system structure is damaged due to an accident/disaster or cyber terrorism. Previous studies mainly focused on recovering record or entry data, which are the basic units of metadata, using carving techniques via a fixed values or values capable of range prediction at the beginning of the data. However, no studies have been conducted on metadata without such fixed values or values capable of range prediction. $LogFile, which is a metadata file of the New Technology File System (NTFS) that is one of the most used file systems at present, contains very important metadata that provide a history of all file system operations during a specific period. However, since there is no fixed value or a value capable of range prediction at the start position of the record, which is the basic unit of $LogFile, there have been no studies on recovery using record units, and only recovery by file and page have been possible. If the file header or page header of $LogFile is damaged, existing recovery methods cannot properly recover the metadata; in such cases, a record-level recovery method is required to recover the metadata. In this context, we investigated the mechanisms of record storage through a detailed analysis of the $LogFile structure and proposed a recovery method for records without fixed values. Our proposed method was implemented as a tool and verified through comparative experiments with existing forensic tools that recover $LogFile data. The experimental results showed that the proposed recovery method was able recover all the data that existing tools are unable to recover in situations where the $LogFile data were damaged. The implemented tools are released free of charge to contribute digital forensic community. Finally, we explained what important role $LogFile played in solving real-world cases and confirm the importance of recovering $LogFile data in situations where file systems may be damaged due to accidents and disasters.

show abstract

“…However, this method can only find metadata records with multiple equivalent timestamps and therefore misses metadata records and files with different but similar timestamps. To address this issue, Portera et al (2021) introduced a prefix-based potential timestamp carving approach, which greatly improves the recall of files and corresponding timestamped metadata without reducing accuracy. With the development of machine learning techniques, deep learning-based methods are also being applied to file recovery (Mohammad & Alqahtani, 2019).…”

Section: Research On File Recoverymentioning

confidence: 99%

“…The experiment showed that the authors' recovery result is the same as what was the standard Linux file system tool debugfs returned, proving the feasibility and correctness of GE. Portera et al's (2021) work are mixed approaches that utilize both MFR and CFR technologies. The difference between the authors' work and Jo et al's (2018), Kim et al's (2021), Lee et al's (2020) and Lee and Shon's (2014) research is that the authors' work recovers files without any support from an OS, while the the others cannot.…”

Section: Feasibility and Correctness Experimentsmentioning

confidence: 99%

“…Different from MFR, CFR does not rely on metadata. It leverages syntactic signatures (e.g., file header-footer pairs) (Tang et al, 2016), semantic structures (e.g., explicit control flow paths within a binary executable) (Hand et al, 2012), heuristic technologies (Garfinkel & McCarrin, 2015;Gladyshev & James, 2017;Pal et al, 2008), timestamps (Nordvik et al, 2020;Portera et al, 2021) or deep learning technologies (Heo et al, 2019;Mohammad & Alqahtani, 2019) to restore files. Unlike MFR, which can precisely recover a file under the "direct guidance" of metadata, CFR "indirectly infers" which data blocks belong to the file to be recovered.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Golden Eye

Zhang

Chen

Zhu

2022

International Journal of Digital Crime and Forensics

View full text Add to dashboard Cite

File systems are important sources of intelligence information and digital evidence. They have long attracted the interest of researchers in recovering files that are deleted from a hard disk. Existing file recovery studies rely heavily on an operating system (OS). However, it is often encountered that OS services are not available, making existing file recovery approaches unusable. To address this issue, the authors design and implement an OS-independent file recovery algorithm named Golden Eye (GE) by targeting the EXT4 file system. Fed the raw image obtained from a (sanitized) hard disk, GE can automatically recover any designated file or even the whole EXT4 file system. GE is based on the understanding of the file disk layout of EXT4 and does not need any support from additional hardware or software. Experimental results prove the feasibility and correctness of GE. This work not only solves the OS dependency problem that most existing file recovery work suffers from but also reveals the fact that even sanitized hard disks are still at risk of leaking sensitive data.

show abstract

Timestamp prefix carving for filesystem metadata extraction

Cited by 5 publications

References 9 publications

Teknik Disk Carving untuk Recovery Solid State Drive Volume ReFS dan NTFS dengan Fitur TRIM

Teknik Disk Carving untuk Recovery Solid State Drive Volume ReFS dan NTFS dengan Fitur TRIM

Forensic Recovery of File System Metadata for Digital Forensic Investigation

Golden Eye

Contact Info

Product

Resources

About