File System Changes Research Articles

A Study of Linux File System Evolution

We conduct a comprehensive study of file-system code evolution. By analyzing eight years of Linux file-system changes across 5079 patches, we derive numerous new (and sometimes surprising) insights into the file-system development process; our results should be useful for both the development of file systems themselves as well as the improvement of bug-finding tools.

A File System Synchronous Algorithm Combining State Transfer and Operation Transfer

In order to realize real-time synchronization of nodes and reduce space overhead by log maintenance in an unstable network, this paper adopts a method that combines the operation transfer-based method and the state transfer-based method. Based on file system synchronization, we design a new synchronous algorithm consisting of the state transform and events merge. the new algorithm can merge file system changes in the millisecond level and realize fast update response. Besides, the new algorithm can accurately identify file update semantics, which can effectively decrease the number of updates operations.

Automated identification of installed malicious Android applications

Increasingly, Android smartphones are becoming more pervasive within the government and industry, despite the limited ways to detect malicious applications installed to these phones' operating systems. Although enterprise security mechanisms are being developed for use on Android devices, these methods cannot detect previously unknown malicious applications. As more sensitive enterprise information becomes available and accessible on these smartphones, the risk of data loss inherently increases. A malicious application's actions could potentially leave sensitive data exposed with little recourse. Without an effective corporate monitoring solution in place for these mobile devices, organizations will continue to lack the ability to determine when a compromise has occurred. This paper presents research that applies traditional digital forensic techniques to remotely monitor and audit Android smartphones. The smartphone sends changed file system data to a remote server, allowing for expensive forensic processing and the offline application of traditional tools and techniques rarely applied to the mobile environment. The research aims at ascertaining new ways of identifying malicious Android applications and ultimately attempts to improve the state of enterprise smartphone monitoring. An on-phone client, server, database, and analysis framework was developed and tested using real mobile malware. The results are promising that the developed detection techniques identify changes to important system partitions; recognize file system changes, including file deletions; and find persistence and triggering mechanisms in newly installed applications. It is believed that these detection techniques should be performed by enterprises to identify malicious applications affecting their phone infrastructure.

BlobCR: Virtual disk based checkpoint-restart for HPC applications on IaaS clouds

Infrastructure-as-a-Service (IaaS) cloud computing is gaining significant interest in industry and academia as an alternative platform for running HPC applications. Given the need to provide fault tolerance, support for suspend–resume and offline migration, an efficient Checkpoint-Restart mechanism becomes paramount in this context. We propose BlobCR, a dedicated checkpoint repository that is able to take live incremental snapshots of the whole disk attached to the virtual machine (VM) instances. BlobCR aims to minimize the performance overhead of checkpointing by persisting VM disk snapshots asynchronously in the background using a low overhead technique we call selective copy-on-write. It includes support for both application-level and process-level checkpointing, as well as support to roll back filesystem changes. Experiments at large scale demonstrate the benefits of our proposal both in synthetic settings and for a real-life HPC application.

Automatic File Indexing Framework: An Effective Approach to Resolve Dangling File Pointers

managing files in a server system has the same magnitude as managing the World Wide Web due to the dynamic nature of the file system. Even searching for files over the file system is time consuming because finding a file on hard disk is a long-running task. Every file on the disk has to be read with dangling pointers to files which no longer exist because they have been changed, moved or deleted. This makes the user frustrated. The Automatic file indexing framework facilitates users to resolve file names and locate documents stored in file repositories. The main design objective of the framework is to maintain sub-indexes at the folder level that have the full knowledge of the revisions that are made at the folder level automatically. This research proposes a framework that manages the creation and maintenance of the file index, with the use of Resources Description Framework (RDF) and retrieval using semantic query languages i.e. SPARQL. The sub-indexes are maintained hierarchically starting from the leaf node to the root node recursively. The proposed framework will monitor the file system continuously and update individual folder descriptors (sub-indexes) stored on each node as the file system changes making the cached indexes resilient to any file changes. The framework is resilient of file or folder name changes. Further, the study explores avenues to build an offline semantic index that can be used by the clients to perform distribute file search without performing the search on the server itself. This is viable since the framework uses semantic languages to describe and build file descriptors that can easily integrate semantic indexing and hence this makes the index readily available for the Web.

FastDu: Efficient Directory Summaries Harvest by Tracking File System Changes

FastDu is a file system service that tracks file system changes by intercepting file system calls to maintain directory summaries, which play important roles in both storage administration and improvement of user experiences for some applications. In most circumstances, directory summaries are independently harvested by applications via traversing the file system hierarchy and calling stat () on every file in each directory. For large file systems, this brute-force traverse-based approach can take many hours to complete, even if only a small percentage of the files have changed. This paper describes FastDu, which uses a pre-built database to store harvested directory summaries, and tracks the file system changes by intercepting file system calls, so that new harvesting is restricted to the small subset of directories that contain modified files. Tests using FastDu show that this approach reduces the time needed to get a directory summary by one or two orders of magnitude with almost negligible penalty to application-aware file system performance.

JFTL

In flash memory-based storage, a Flash Translation Layer (FTL) manages the mapping between the logical addresses of a file system and the physical addresses of the flash memory. When a journaling file system is set up on the FTL, the consistency of the file system is guaranteed by duplications of the same file system changes in both the journal region of the file system and the home locations of the changes. However, these duplications inevitably degrade the performance of the file system. In this article we present an efficient FTL, called JFTL , based on a journal remapping technique. The FTL uses an address mapping method to write all the data to a new region in a process known as an out-of-place update. Because of this process, the existing data in flash memory is not overwritten by such an update. By using this characteristic of the FTL, the JFTL remaps addresses of the logged file system changes to addresses of the home locations of the changes, instead of writing the changes once more to flash memory. Thus, the JFTL efficiently eliminates redundant data in the flash memory as well as preserving the consistency of the journaling file system. Our experiments confirm that, when associated with a writeback or ordered mode of a conventional EXT3 file system, the JFTL enhances the performance of EXT3 by up to 20%. Furthermore, when the JFTL operates with a journaled mode of EXT3, there is almost a twofold performance gain in many cases. Moreover, the recovery performance of the JFTL is much better than that of the FTL.

Methodologies for the use of VMware to boot cloned/mounted subject hard disk images

This paper represents part of the work that was submitted for the RMCS Shrivenham/Cranfield University MSc in Forensic Computing in March 2005. An investigation into the restoration of forensically acquired digital data to virtual hardware was undertaken. The objective of the investigation was to devise a methodology by which a subject operating system could be booted in a virtual environment. This would enable the investigator to experience the subject system in a controlled environment where file system changes could be discarded and the ‘original’ clone preserved for future, repeatable usage. During the research and experimentation stages of this project, the following software was utilised: • Encase 3.22g was the primary forensic imaging tool. • Mount Image Pro 1.05 was used to mount the forensic image files as a physical disk. • Symantec Ghost 2003 was used to clone the physical disk to a new virtual disk. • VMware 4.5.2 build-8848 was the virtual machine software used. The underlying architecture of VMware is Intel based. • Microsoft Windows XP was used as the host examination system. During the research phase of this project, the host examination machines utilised both Intel and VIA (AMD processor) architectures.