A metadata-based method for recovering files and file traces from YAFFS2

Xu, Ming; Yang, Xue; Wu, Beibei; Yao, Jun; Zhang, Haiping; Xu, Jian; Zheng, Ning

doi:10.1016/j.diin.2013.02.006

Cited by 16 publications

(11 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…During the scanning process, useful information is stored in an array and the timeline of SQLite operating log is constructed. Based on previous studies [5,11], they further proposed a metadata-based method for recovering file traces that contain all the versions of files from YAFFS2 [12].…”

Section: Related Workmentioning

confidence: 99%

“…A page is further divided into usable and spare areas. The usable area is used to store user data while the spare area is used to store file system metadata [5,12]. There is a limit on the number of times that NAND flash blocks can be reliably programmed and erased.…”

Section: Yaffs and Tnode Tree 31 The Nand Flashmentioning

confidence: 99%

“…There are thus two types of chunks: data chunks and object header chunks [10]. Data chunks contain the actual file content while object header chunks contain file/directory metadata and descriptor information, such as file size, object name and creation time [12]. Each chunk has Tags in the spare area that holds additional information such as the chunk ID, serial number, number of bytes and object ID.…”

Section: Main Characteristics Of Yaffs2：thementioning

confidence: 99%

“…Files stored on the NAND chips have unique identities, i.e., the object IDs, since they are regarded as objects by the file system. When a file is modified, the file system will store the new data in empty pages and add a new object header [12]. When a file is deleted, YAFFS2 will write a new object header at the end of the file to indicate that the file has been deleted.…”

Section: Main Characteristics Of Yaffs2：thementioning

confidence: 99%

See 3 more Smart Citations

Recovering YAFFS2 Files for Forensic Analysis Based on Timestamps and Tnode Trees

Huang¹,

He²,

Zhao³

et al. 2015

IJHIT

View full text Add to dashboard Cite

As Android-based intelligent devices get more popular, digital technologies for forensic investigation have received increasingly more attention. Among the main technical issues in digital forensics, however, data recovery requires a significant amount of effort. In this paper, we first analyze the characteristics of the NAND flash storage as well as the mechanisms in the YAFFS2 file system. We then propose a file reconstruction method based on timestamps using Tnode trees in the YAFFS2 file system. Based on the last access timestamp information in the object header and the process of creating Tnode tree, the proposed method can be used to locate valid data blocks so as to recover the original files and would thus be able to reconstruct the file system. Experiments conducted under the Linux operating system over image files show that the proposed method could recover the final version of files effectively and would also perform more efficiently compared to similar methods.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Yaffs and Tnode Tree 31 The Nand Flashmentioning

confidence: 99%

Section: Main Characteristics Of Yaffs2：thementioning

confidence: 99%

Section: Main Characteristics Of Yaffs2：thementioning

confidence: 99%

See 2 more Smart Citations

Recovering YAFFS2 Files for Forensic Analysis Based on Timestamps and Tnode Trees

Huang¹,

He²,

Zhao³

et al. 2015

IJHIT

View full text Add to dashboard Cite

show abstract

“…In YAFFS2, there are thus two types of chunks: data chunks and object header chunks [5]. Data chunks contain the actual file content while object header chunks contain file/directory metadata and descriptor information, such as file size, object name and creation time [10]. Each chunk has Tags in the spare area that holds additional information such as the chunk ID, serial number, number of bytes and object ID.…”

Section: The Proposed Methodsmentioning

confidence: 99%

Secure Data Sanitization for Android Device Users

Huang¹,

He²,

Zhao³

2015

IJSIA

View full text Add to dashboard Cite

To protect the data confidentiality of Android device users, this paper proposed a user-level secure data sanitization method which can make sensitive data stored in flash memory unrecoverable. The proposed method using reversed-scanning algorithm to reduce time and it don't need overwriting or erase the whole flash memory. After sensitive data pages are found, the program targetedly overwriting some blocks, erase them, and insert them into free block list waiting to be located again which means the blocks will be twice overwrited by new data.

show abstract

A Method of Recovering HBase Records from HDFS Based on Checksum File

Lin

et al. 2017

Collaborate Computing: Networking, Applications and Worksharing

View full text Add to dashboard Cite

A metadata-based method for recovering files and file traces from YAFFS2

Cited by 16 publications

References 2 publications

Recovering YAFFS2 Files for Forensic Analysis Based on Timestamps and Tnode Trees

Recovering YAFFS2 Files for Forensic Analysis Based on Timestamps and Tnode Trees

Secure Data Sanitization for Android Device Users

A Method of Recovering HBase Records from HDFS Based on Checksum File

Contact Info

Product

Resources

About