File System Data Research Articles

Analysis Of Deleted Data In NTFS Filesystem

Analysis Of Deleted Data In NTFS Filesystem

Assessment of uniformity of byte distribution in a file based on the wavelet transform as an approach to search encrypted data

This article is focused on the search of the encrypted data in the file system, which is an important step in digital forensics. Encryption is widely used today, among others by malefactors to conceal data, suggesting that encrypted information can be hidden in the file system. There are means of detection of encrypted files, but they have significant limitations and may not be used for the free space of the file system. Statistical tests can also be used for this purpose but they are resource and time consuming. Therefore, the article proposes a new approach to searching for encrypted data, based on the assessment of uniformity of data, with the ability to localise the heterogeneity, which reduces type I error to zero. This approach has its drawbacks, in the form of type II errors; however it can be improved by manipulating parameters that are used for assessment of uniformity.

Survey of Digital Forensics Technologies and Tools for Android based Intelligent Devices

During the rapid development of mobile wireless technologies and applications, the Android operating system, due to its open-source characteristics, has become the most popular development platform in the smartphone market. Meanwhile, as Android-based intelligent mobiles devices experience a rapid increase in numbers, high-tech crimes involving such devices have become more versatile, affecting an ever increasing amount of data, thus making digital evidence an indispensable part of the evidence that needs to be seriously dealt with during crime investigations. Consequently, understanding the internal structure of Android and the various data operations in the file systems becomes necessary in Android-based digital forensics. In this paper, we survey the state-of-the-art of technologies in Android-based digital forensics and some popular tools in the aspects of data recovery and acquisition, file system analysis and data analysis. We also discuss some technical challenges and point out future research directions in Android-based digital forensics.

Methodologies for Geotagging in FAT and ExFAT File Systems for Smart Phones

Methodologies for Geotagging in FAT and ExFAT File Systems for Smart Phones

Attack tolerant architecture for big data file systems

Data driven decisions derived from big data have become critical in many application domains, fueling the demand for collection, transportation, storage and processing of massive volumes of data. Such applications have made data a valuable resource that needs to be provided appropriate security. High value associated with big data sets has rendered big data storage systems attractive targets for cyber attackers, whose goal is to compromise the Confidentiality, Integrity and Availability of data and information. Common defense strategy for protecting cyber assets has been to first take preventive measures, and if these fail, detecting intrusions and finally recovery. Unfortunately, attackers have developed tremendous technical sophistication to defeat most defensive mechanisms. Alternative strategy is to design architectures which are intrinsically attack tolerant. This paper describes a technique that involves eliminating single point of security failures through fragmentation, coding, dispersion and reassembly. It is shown that this technique can be successfully applied to routing, networked storage systems, and big data file systems to make them attack tolerant.

Entwicklungslinien eines grundrechtsgeprägten Sicherheitsverwaltungsrechts

The Framework of a Security Law guided by Human Rights The discussion on the security architecture in Germany was triggered by the terrorist attacks after 9/11. This security architecture not only concerns the tasks and structures of the police and intelligence agencies, but also civil protection and the inclusion of private companies. In the context of this interdisciplinary approach, national security law focuses on providing security by state authorities. The powers of these authorities are outlined and limited by human rights. For police authorities this is not a new development. Nevertheless, within a security architecture of considerable complexity the influence of human rights is of growing importance. The development of the German security law is influenced by progressive Europeanization and internationalization. The European Court of Human Rights decides on a case-by-case basis on aspects of security. Regarding the European Union, what matters is not only the law regulating the powers and cooperation of law enforcement authorities, but also reforming the European protection of personal data, including a directive on justice and police. Due to social changes in the information society, the role of network systems is also growing in security. Processing personal data is of crucial importance for providing security. In Germany, the collection and the transmission of data in interrelated data file systems, in which numerous authorities including intelligence services may be involved, are governed by new legal provisions. Cooperation of different authorities, which may apply different laws, has to be guided by a special legal framework. As a consequence, the design of the legal regime for providing internal security is essentially influenced by elements of the regime of data protection. The German Federal Constitutional Court in its jurisprudence has elaborated the outlines of this legal regime concerning the collection of data at an early stage, i.e. before a concrete risk has realized, and the transmission of data between law enforcement authorities on an automatized basis. Police forces still interfere with citizens' rights in a physical way using the traditional means of law enforcement, e.g. search and seizure. However, the interference by means of data collection or transmission is increasingly important because of social changes and European cooperation. National security law has to be reconsidered in the light of data networking. As a consequence, the human right to the protection of personal data is the core element for the development of security law.

NanoFS: a hardware‐oriented file system

NanoFS is a novel file system for embedded systems and storage-class memories (like flash) and is specially designed to be directly implemented in hardware. NanoFS is based on an original internal layout intended to achieve an optimal hardware implementation of the file system's file lookup and data fetch operations. File system specification on a sample reader module completely implemented in a programmable device is introduced.

Sceadan: Using Concatenated N-Gram Vectors for Improved File and Data Type Classification

Over 20 studies have been published in the past decade involving file and data type classification for digital forensics and information security applications. Methods using n-grams as inputs have proven the most successful across a wide variety of types; however, there are mixed results regarding the utility of unigrams and bigrams as inputs independently. In this study, we use support vector machines (SVMs) consisting of unigrams and bigrams, as well as complexity and other byte frequency-based measures, as inputs. Using concatenated unigrams and bigrams as input and a linear kernel SVM, we achieve significantly improved results over those previously reported (73.4% classification rate across 38 file and data types). We are the first to use concatenated n-grams as the sole input, and we show their superiority over inputs used previously. We also found that too many different types of features as inputs result in overfitting and poor generalization properties. We include several types seldom or not studied in the past (Microsoft Office 2010 files, file system data, base64, base85, URL encoding, flash video, M4A, MP4, WMV, and JSON records). The “winning” approach is instantiated in an open source software tool called Sceadan - Systematic Classification Engine for Advanced Data ANalysis.

Automated identification of installed malicious Android applications

Increasingly, Android smartphones are becoming more pervasive within the government and industry, despite the limited ways to detect malicious applications installed to these phones' operating systems. Although enterprise security mechanisms are being developed for use on Android devices, these methods cannot detect previously unknown malicious applications. As more sensitive enterprise information becomes available and accessible on these smartphones, the risk of data loss inherently increases. A malicious application's actions could potentially leave sensitive data exposed with little recourse. Without an effective corporate monitoring solution in place for these mobile devices, organizations will continue to lack the ability to determine when a compromise has occurred. This paper presents research that applies traditional digital forensic techniques to remotely monitor and audit Android smartphones. The smartphone sends changed file system data to a remote server, allowing for expensive forensic processing and the offline application of traditional tools and techniques rarely applied to the mobile environment. The research aims at ascertaining new ways of identifying malicious Android applications and ultimately attempts to improve the state of enterprise smartphone monitoring. An on-phone client, server, database, and analysis framework was developed and tested using real mobile malware. The results are promising that the developed detection techniques identify changes to important system partitions; recognize file system changes, including file deletions; and find persistence and triggering mechanisms in newly installed applications. It is believed that these detection techniques should be performed by enterprises to identify malicious applications affecting their phone infrastructure.

An analysis of Ext4 for digital forensics

This paper presents a low-level study and analysis of Ext4 file system data structures. It includes descriptions of extents, extent trees, directory indexing HTrees, and flex block groups. Currently, data about the file system is scattered with most sources focusing on one particular feature. This paper provides a more comprehensive analysis with the forensics community in mind and states some brief implications of the file system behavior with respect to data recovery.

VM aware journaling: improving journaling file system performance in virtualization environments

SUMMARYJournaling file systems, which are widely used in modern operating systems, guarantee file system consistency and data integrity by logging file system updates to a journal, which is a reserved space on the storage, before the updates are written to the data storage. Such journal writes increase the write traffic to the storage and thus degrade the file system performance, especially in full data journaling, which logs both metadata and data updates. In this paper, a new journaling approach is proposed to eliminate journal writes in server virtualization environments, which are gaining in popularity in server platforms. Based on reliable hardware subsystems and virtual machine monitor (VMM), the proposed approach eliminates journal writes by retaining journal data (i.e. logged file system updates) in the memory of each virtual machine and ensuring the integrity of these journal data through cooperation between the journaling file systems and the VMM. We implement the proposed approach in Linux ext3 in the Xen virtualization environment. According to the performance results, a performance improvement of up to 50.9journaling approach of ext3 due to journal write elimination. In metadata‐write dominated workloads, this approach could even outperform the metadata journaling approaches of ext3, which do not guarantee data integrity. These results demonstrate that, on virtual servers with reliable VMM and hardware subsystems, the proposed approach is an effective alternative to traditional journaling approaches. Copyright © 2011 John Wiley & Sons, Ltd.

Design and Evaluation of MPI File Domain Partitioning Methods under Extent-Based File Locking Protocol

MPI collective I/O has been an effective method for parallel shared-file access and maintaining the canonical orders of structured data in files. Its implementation commonly uses a two-phase I/O strategy that partitions a file into disjoint file domains, assigns each domain to a unique process, redistributes the I/O data based on their locations in the domains, and has each process perform I/O for the assigned domain. The partitioning quality determines the maximal performance achievable by the underlying file system, as the shared-file I/O has long been impeded by the cost of file system's data consistency control, particularly due to the conflicted locks. This paper proposes a few file domain partitioning methods designed to reduce lock conflicts under the extent-based file locking protocol. Experiments from four I/O benchmarks on the IBM GPFS and Lustre parallel file systems show that the partitioning method producing minimum lock conflicts wins the highest performance. The benefit of removing conflicted locks can be so significant that more than thirty times of write bandwidth differences are observed between the best and worst methods.

Different interpretations of ISO9660 file systems

In this paper, we examine the potential to hide data in an ISO9660 file system, which is used to store data on CD-ROMs. By design, this file system allows for multiple directory trees and different byte orderings of essential data. We describe how data could be hidden in an ISO9660 file system and create test images using the described techniques. We test commonly used forensics tools to determine if the hidden data can be seen. The test results show that different tools show and hide different data. Some tools show all of the data, some tools show some of the data, and other tools show none of the data.

The Submission Data File System: automating the creation of CDISC SDTM and ADaM datasets

AbstractFrom its inception the SDF System was designed to tackle many of the difficulties that have plagued statistical programming ever since the first programs were developed to analyze clinical trial data. The system scope includes the following areas:•Automating front-end and back-end data security•Providing rapid access to raw and derived datasets to all sites within the organization•Implementing large scale systems design and software engineering principles in the clinical trials programming domain to reduce the software development effort required for each statistical analysis•Modeling the complex relationships inherent within clinical data to provide sophisticated impact analysis tools with the capability to manage and cascade change•Implementing an object-oriented (OO) approach to the definition and reuse of clinical data standards•Improving review and quality control processes by coupling the specification of a program together with it's source code to create one logical entity•Reducing the vali...

Implementing filesystems by tree-aware DBMSs

With the rise of XML, the database community has been challenged by semi-structured data processing. Since the data type behind XML is the tree, state-of-the-art RDBMSs have learned to deal with such data ( e. g. , [18, 5, 6, 16]). This paper introduces a Ph.D. project focused on the question in how far the tree-awareness of recent RDBMSs can be used to, once again, try to implement filesystems using database technology. Our main goal is to provide means to query the data stored in filesystems and to find ways to enhance/combine the data storage and query capabilities of operating systems using semi-structured database technology. Two DBMSs with relational XML storage, built on top of the XPath accelerator numbering scheme [14], are the foundations for our work. With BaseX, an XML database, we establish a link between user, database and filesystem content. BaseX allows visual access to filesystem data stored in the database. An integrated query interface allows users to filter query results in interactive response time. Second, we establish a link between DBMS and OS. We implement a filesystem in userspace backed by the MonetDB/XQuery system, a well-known relational database system, which integrates the Pathfinder XQuery compiler [5] and the MonetDB kernel [4]. As a result, the DBMS is mounted as a conventional filesystem by the operating system kernel. Consequently, access via the established (virtual) filesystem interface as well as database enhanced access to the same data is provided.

Practical techniques for purging deleted data using liveness information

The layered design of the Linux operating system hides the liveness of file system data from the underlying block layers. This lack of liveness information prevents the storage system from discarding blocks deleted by the file system, often resulting in poor utilization, security problems, inefficient caching, and migration overheads. In this paper, we define a generic "purge" operation that can be used by a file system to pass liveness information to the block layer with minimal changes in the layer interfaces, allowing the storage system to discard deleted data. We present three approaches for implementing such a purge operation: direct call, zero blocks, and flagged writes, each of which differs in their architectural complexity and potential performance overhead. We evaluate the feasibility of these techniques through a reference implementation of a dynamically resizable copy on write (COW) data store in User Mode Linux (UML). Performance results obtained from this reference implementation show that all these techniques can achieve significant storage savings with a reasonable execution time overhead. At the same time, our results indicate that while the direct call approach has the best performance, the zero block approach provides the best compromise in terms of performance overhead and its semantic and architectural simplicity. Overall, our results demonstrate that passing liveness information across the file system-block layer interface with minimal changes is not only feasible but practical.

Data Acquisition from Cell Phone using Logical Approach

Abstract — Cell phone forensics to acquire and analyze data in the cellular phone is nowadays being used in a national investigation organization and a private company. In order to collect cellular phone flash memory data, we have two methods. Firstly, it is a logical method which acquires files and direct ories from the file system of the cell phone flash memory. Secondly, we can get all data from bit-by-bit copy of entire physical memory using a low level access method. In this paper, we describe a forensic tool to acquire cell phone flash memory data using a logical level approach. By our tool, we can get EFS file system and peek memory data with an arbitrary region from Korea CDMA cell phone. Keywords — Forensics, logical method, acquisition, cell phone, flash memory.I. I NTRODUCTION S digital evidence that kept in the various electronic media such as a computer and a mobile device in the digital crime is recently increasing, digital forensic technology to prove the crime is being more and more important. Especially, if the critical evidence is stored in the mobile devices, mobile forensic technology is demanded to find out the evidence without damage of the evidence. Mobile devices include small scale digital devices, embedded system, portable storage devices, and obscure devices. And, as to the small scale digital devices, there are various types of cell phones, USIM, PDA, navigation system, game player, and so on. In this paper, we are focusing in acquiring and analyzing data in the cell phone. User data such as phonebook, call history, SMS, and photo and hardware-related data such as IMSI, MIN, and ESN are mainly stored in the NAND flash memory and the NOR flash memory of the cell phone. In case of Korea, most of

HFS

Two oft-cited file systems, the Fast File System (FFS) and the Log-Structured File System (LFS), adopt two sharply different update strategies--- update-in-place and update-out-of-place . This paper introduces the design and implementation of a hybrid file system called hFS, which combines the strengths of FFS and LFS while avoiding their weaknesses. This is accomplished by distributing file system data into two partitions based on their size and type. In hFS, data blocks of large regular files are stored in a data partition arranged in a FFS-like fashion, while metadata and small files are stored in a separate log partition organized in the spirit of LFS but without incurring any cleaning overhead . This segregation makes it possible to use more appropriate layouts for different data than would otherwise be possible. In particular, hFS has the ability to perform clustered I/O on all kinds of data---including small files, metadata, and large files. We have implemented a prototype of hFS on FreeBSD and have compared its performance against three file systems, including FFS with Soft Updates, a port of NetBSD's LFS, and our lightweight journaling file system called yFS. Results on a number of benchmarks show that hFS has excellent small file and metadata performance. For example, hFS beats FFS with Soft Updates in the range from 53% to 63% in the PostMark benchmark.

Architecture and Performance of a Grid-Enabled Lookup-Based Biomedical Optimization Application: Light Scattering Spectroscopy

This paper presents a case study of a Grid-enabled implementation of light scattering spectroscopy (LSS). The LSS technique allows noninvasive detection of precancerous changes in human epithelium, differentiating from traditional biopsies by allowing in vivo diagnosis of tissue samples and quantitative analyses of parameters related to cancerous changes via numerical techniques. This paper describes the architecture of GridLSS and its integration with a Web-based Grid computing portal. GridLSS solves an optimization problem of determining the light scattering spectrum that best fits experimental spectral data among a large set of spectra computed analytically using rigorous Mie theory. The novel approach taken in this paper is based on the precomputation and storage of Mie theory spectra in lookup databases that are queried during the minimization process. The paper makes three important contributions: 1) it presents a novel parallel application for LSS analysis that delivers high performance in wide-area distributed computing environment; 2) it evaluates and analyzes the performance of this application in cluster-based high-performance computing environments that are typical of Grid deployments; and 3) it shows that the performance of GridLSS benefits significantly from the use of on-demand Grid data transfers based on virtualized distributed file systems and from user-level caches for remote file system data.

Data hiding in the NTFS file system

In this paper we examine the methods of hiding data in the NTFS file system. Further we discuss the analysis techniques which can be applied to detect and recover data hidden using each of these methods. We focus on sophisticated data hiding where the goal is to prevent detection by forensic analysis. Obvious data hiding techniques, for example setting the hidden attribute of a file, will not be included. Hidden data can be further obfuscated by file system independent approaches like data encryption and steganography. This paper is only concerned with the methods which are made possible by the structure of the NTFS file system, and with the recovery of hidden data, not its interpretation.