The Research on the Recovery Techniques of Deleted Files in the XFS Filesystem

Abstract

The files in computer storages can be deleted due to unexpected failures or accidents. Some malicious users often delete data by himself for anti-forensics. If deleted files are associated with crimes or important documents in business, they should be recovered and the recovery tool is necessary. The recovery methods and tools for some filesystems such as NTFS, FAT, and EXT have been developed actively. However, there has not been any researches for recovering deleted files in XFS filesystem applied to NAS or CCTV. In addition, since the current related tools are based on the traditional signature detection methods, they have low recovery rates. Therefore, this paper suggests the recovery methods for deleted files based on metadata and signature detection in XFS filesystem, and verifies the results by conducting experiment in real environment.

Ext4 and XFS File System Forensic Framework Based on TSK

“…In 2014, a study on the structure of the XFS file system and recovery of deleted files was conducted based on XFS file system v4. For the recovery, the inode of the deleted file was located, and the address of the bitmap block or its signature was used [7]. However, this recovery method cannot recover a deleted file if the bitmap block value has been overwritten.…”

“…However, the metadata analysis for file recovery is insufficient, and determining whether it has been normally extracted and recovered is difficult because hash value comparisons between the original and recovered files are not performed. Park et al [7] and Ahn et al [8] also proposed a file recovery method considering that the deleted inode is stored in the journal area, and the extent indicating the location of the actual data in the file is not deleted. However, the metadata analysis used for file recovery is insufficient.…”

“…In some studies, a file extraction and recovery method based on the open metadata of the Ext2/3 file system [4] and a deleted file recovery method based on the journal area of the Ext4 file system [5,6] have been suggested. Moreover, studies on the metadata analysis of the XFS file system and the recovery method of deleted files have been implemented [7][8][9]. Most of the studies on file extraction and recovery methods for file systems are performed based on metadata and journal areas; hence, an accurate analysis of the structure of the file system is required.…”