论文信息 - File Carving for Ext4 File System on Android OS

File Carving for Ext4 File System on Android OS

A lot of OS(Operating Systems) such as Linux and Android selected Ext4 as the official file system. Therefore, a recovery of deleted file from Ext4 is becoming a pending issue. In this paper, we suggest how to recover the deleted file by analyzing the entire structure of Ext4 file system, the study of metadata area, the distinct feature when file is assigned and deleted. Particularly, we focus on studying the features of file which is assigned in Ext4 file system in Android OS and also suggest the method to recover the deleted file that is fragmented from the un-allocated area.

Sangjin Lee | Jungheum Park | Dohyun Kim

[1] Simson L. Garfinkel,et al. Carving contiguous and fragmented files with fast object validation , 2007, Digit. Investig..

[2] Kevin D. Fairbanks. An analysis of Ext4 for digital forensics , 2012 .

[3] Sangjin Lee,et al. An Efficient Method of Extracting Strings from Unfixed-Form Data , 2012 .

[4] Sangjin Lee,et al. Forensic analysis techniques for fragmented flash memory pages in smartphones , 2012, Digit. Investig..

[5] Golden G. Richard,et al. In-Place File Carving , 2007, IFIP Int. Conf. Digital Forensics.