An Advanced File Recovery on XFS
An Advanced File Recovery on XFS
- 주제(키워드) Digital Forensics , Digital Investigation , Deleted File Recovery , XFS File System , Journaling File System , File System Metadata
- 발행기관 아주대학교
- 지도교수 손태식
- 발행년도 2016
- 학위수여년월 2016. 2
- 학위명 석사
- 학과 및 전공 일반대학원 컴퓨터공학과
- 실제URI http://www.dcollection.net/handler/ajou/000000022016
- 본문언어 영어
- 저작권 아주대학교 논문은 저작권에 의해 보호받습니다.
초록/요약
At present, as the amount of digitized information is increasing geometrically, the importance of digitized information as critical clues from the perspective of criminal investigation is also increasing. According to this trend, the importance of digital forensics has also magnified. As a fundamental technique of digital forensics, recovery of data deleted to conceal information is extremely important and needs to be studied. The XFS file system was designed to process huge files, and thus it is expected to be applied in server systems. In this paper, we analyze the XFS file system using its structure and metadata information; then, we propose a technique to recover the deleted files through previous analysis results, and verify it through testing.
more목차
1. INTRODUCTION 1
2. BACKGROUND AND APPLICATION 3
2.1 XFS File System 3
2.1.1 Feature 3
2.1.2 Structure 4
2.2 Digital Forensics 5
2.2.1 History 5
2.2.2 Standard Procedure 6
2.2.3 Elements for Having Legal Force 7
2.2.4 Applicable Areas 9
3. ANALYSIS OF XFS FILE SYSTEM METADATA 12
3.1 Key Elements for File Recovery 12
3.1.1 Superblock 12
3.1.2 Inode Core 13
3.1.3 Data Fork 14
3.1.4 Journaling 15
3.2 Deleted Mechanism based on Data Fork 17
3.2.1 Directory 17
3.2.2 Regular File 27
4. PROPOSED RECOVERY METHODOLOGY 29
4.1 Recovery Procedure 29
4.2 Recovery Methodology 29
5. TEST AND RESULT 32
6. CONCLUSION 33
