Abstract
Since B-tree file system (Btrfs) is set to become de facto standard file system on Linux (and Linux based) operating systems, Btrfs dataset for forensic analysis is of great interest and immense value to forensic community. This article presents a novel dataset for forensic analysis of Btrfs that was collected using a proposed data-recovery procedure. The dataset identifies various generalized and common file system layouts and operations, specific node-balancing mechanisms triggered, logical addresses of various data structures, on-disk records, recovered-data as directory entries and extent data from leaf and internal nodes, and percentage of data recovered.
Highlights
Since B-tree file system (Btrfs) is set to become de facto standard file system on Linux operating systems, Btrfs dataset for forensic analysis is of great interest and immense value to forensic community
This article presents a novel dataset for forensic analysis of Btrfs that was collected using a proposed datarecovery procedure
Forensic analysis of file systems generally relies on data recovery to yield credible and conclusive investigation [1,2,3]
Summary
Linux operating system is most commonly and widely used operating system across all platforms and domains. The idea behind Ext design was to create a stop-gap solution until a stable version of Btrfs was ready [6] Btrfs addresses these challenges of reliability, scalability and performance by providing simple administration, end-to-end data integrity, and immense scalability without loss of performance. Btrfs delivers what Ext fails to, i.e., maintaining an even performance across sensitive, intense and diverse workloads managed by Linux operating systems, be it smartphones, enterprise production servers, or modern super computers. With such a diverse and sensitive workload to shoulder, Btrfs is at the spotlight of hackers, malicious-code writers and cyber criminals. With the inevitable adoption of Btrfs across wide platforms and diverse workloads, forensic dataset of Btrfs is of greater interest and bigger value to forensic community
Sign-in/Register to view highlights & summary Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
