Reconstructing fragmented YAFFS2 files for forensic analysis - 文章详情页

作者：

Huang, Na (Huang, Na.) | He, Jingsha (He, Jingsha.) (学者：何泾沙) | Zhao, Bin (Zhao, Bin.) | Liu, Gongzheng (Liu, Gongzheng.) | Wan, Xuejiao (Wan, Xuejiao.)

收录：

摘要：

Data　recovery　from　captured　intelligent　mobile　devices　such　as　smartphones　plays　a　significant　role　in　digital　forensic　analysis.　In　this　paper,　we　study　the　main　characteristics　of　NAND　flash　and　YAFFS2　file　systems　and　explore　the　method　for　recovering　YAFFS2　files　for　forensic　analysis　based　on　Tnode　tree　that　can　save　a　lot　of　time　compared　to　other　data　recovery　methods.　For　any　broken　file　that　has　missing　or　broken　data　pages,　we　propose　to　reuse　pages　from　previous　versions　of　the　current　file　based　on　the　chunk　IDs　of　the　missing　pages　to　replace　and　thus　recover　such　pages.　We　will　describe　the　replacement　method　with　detailed　steps　and　also　perform　some　analysis　to　show　that　the　proposed　replacement　approach　can　be　feasible　and　effective　in　reconstructing　YAFFS2　files.　©　2015　SERSC.

关键词：

Trees (mathematics) Mobile devices Recovery Electronic crime countermeasures Digital devices

作者机构：

[ 1 ] [Huang, Na]School of Software Engineering, Beijing University of Technology, Beijing; 100124, China
[ 2 ] [He, Jingsha]School of Software Engineering, Beijing University of Technology, Beijing; 100124, China
[ 3 ] [Zhao, Bin]School of Software Engineering, Beijing University of Technology, Beijing; 100124, China
[ 4 ] [Liu, Gongzheng]School of Software Engineering, Beijing University of Technology, Beijing; 100124, China
[ 5 ] [Wan, Xuejiao]School of Software Engineering, Beijing University of Technology, Beijing; 100124, China

通讯作者信息：

电子邮件地址：

查看成果更多字段

成果类型
所属机构

所有年份指定年份从至