Underlying File System Research Articles

Forensic implications of stacked file systems

While file system analysis is a cornerstone of forensic investigations and has been extensively studied, certain file system classes have not yet been thoroughly examined from a forensic perspective. Stacked file systems, which use an underlying file system for data storage instead of a volume, are a prominent example. With the growth of cloud infrastructure and big data, it is increasingly likely that investigators will encounter distributed stacked file systems, such as MooseFS and the Hadoop File System, that employ this architecture. However, current standard models and tools for file system analysis fall short of addressing the complexities of stacked file systems. This paper highlights the forensic challenges and implications associated with stacked file systems, discussing their unique characteristics in the context of forensic analyses. We provide insights through three analyses of different stacked file systems, illustrating their operational details and emphasizing the necessity of understanding this file system category during forensic investigations. For this purpose, we present general considerations that must be made when dealing with the analysis of stacked file systems.

DITIS: A Distributed Tiered Storage Simulator

This paper presents DITIS, a simulator for distributed and tiered file-based storage systems. In particular, DITIS can model a distributed storage system with up to three levels of storage tiers and up to three additional levels of caches. Each tier and cache can be configured with different number and type of storage media devices (e.g., HDD, SSD, NVRAM, DRAM), each with their own performance characteristics. The simulator utilizes the provided characteristics in fine-grained performance cost models (which are distinct for each device type) in order to compute the duration time of each I/O request processed on each tier. At the same time, DITIS simulates the overall flow of requests through the different layers and storage nodes of the system using numerous pluggable policies that control every aspect of execution, ranging from request routing and data redundancy to cache and tiering strategies. For performing the simulation, DITIS adapts an extended version of the Actor Model, during which key components of the system exchange asynchronous messages with each other, much like a real distributed multi-threaded system. The ability to simulate the execution of a workload in such an accurate and realistic way brings multiple benefits for its users, since DITIS can be used to better understand the behavior of the underlying file system as well as evaluate different storage setups and policies.

Container-Based Fast Service Migration Method for Mobile Edge Computing

Mobile edge computing (MEC) provides users with low-latency, high-bandwidth, and high-reliability services by migrating the computing power of the cloud computing center to the edge of the network. It is thus being considered an effective solution for the contradiction between the limited computing capabilities of Internet of Things (IoT) devices and the rapid development of delay-sensitive real-time applications. In this study, we propose and design a container union file system based on the differencing hard disk and dynamic loading strategy to address the excessively long migration time caused by the bundling transmission of the file system and container images during container-based service migration. The proposed method involves designing a mechanism based on a remote dynamic loading strategy to avoid the downloading of all container images, thereby reducing the long preparation time before which stateless migration can begin. Furthermore, in view of the excessive latency of the edge service during the stateful migration process, a strategy for avoiding the transmission of the underlying file system and container images is designed to optimize the service interruption time and service quality degradation time. Experiments show that the proposed method and strategy can effectively reduce the migration time of container-based services.

Techniques for Measuring the Probability of Adjacency between Carved Video Fragments: The VidCarve Approach

File carving is a powerful technique for both digital forensics investigations and data recovery. It offers the flexibility to recover data stored on digital media independent of the underlying file system. Thus, it can be used in the cases where we need to recover deleted files or when we have a corrupted, overwritten, or unknown file system. In this paper, we present a novel video file carving (VidCarve) framework to recover and reassemble fragmented video files into playable video files. VidCarve consists of four main components: identification and recovery, weight assignment, reassembly, and file construction. This paper focuses on the weight assignment and reassembly processes where the codec specification parameters of carved fragments were overwritten. We propose several weight assignment techniques to estimate the probability of adjacency between video fragments. Based on these weights, the reassembly algorithm recovers the video files by constructing their correct sequences. We provide experimental results for the proposed techniques of weight assignment and reassembly. We claim that the overall accuracy rate can produce forensically sound evidence and play a critical role in the process of digital evidence recovery in many criminal cases.

An Integrated Indexing and Search Service for Distributed File Systems

Data services such as search, discovery, and management in scalable distributed environments have traditionally been decoupled from the underlying file systems, and are often deployed using external databases and indexing services. However, modern data production rates, looming data movement costs, and the lack of metadata, entail revisiting the decoupled file system-data services design philosophy. In this article, we present TagIt, a scalable data management service framework aimed at scientific datasets, which can be integrated into prevalent distributed file system architectures. A key feature of TagIt is a scalable, distributed metadata indexing framework, which facilitates a flexible tagging capability to support data discovery. Furthermore, the tags can also be associated with an active operator, for pre-processing, filtering, or automatic metadata extraction, which we seamlessly offload to file servers in a load-aware fashion. We have integrated TagIt into two popular distributed file systems, i.e., GlusterFS and CephFS. Our evaluation demonstrates that TagIt can expedite data search operation by up to 10× over the extant decoupled approach.

Query Execution Optimization in Spark SQL

Spark SQL is a big data processing tool for structured data query and analysis. However, due to the execution of Spark SQL, there are multiple times to write intermediate data to the disk, which reduces the execution efficiency of Spark SQL. Targeting on the existing issues, we design and implement an intermediate data cache layer between the underlying file system and the upper Spark core to reduce the cost of random disk I/O. By using the query pre-analysis module, we can dynamically adjust the capacity of cache layer for different queries. And the allocation module can allocate proper memory for each node in cluster. According to the sharing of the intermediate data in the Spark SQL workflow, this paper proposes a cost-based correlation merging algorithm, which can effectively reduce the cost of reading and writing redundant data. This paper develops the SSO (Spark SQL Optimizer) module and integrates it into the original Spark system to achieve the above functions. This paper compares the query performance with the existing Spark SQL by experiment data generated by TPC-H tool. The experimental results show that the SSO module can effectively improve the query efficiency, reduce the disk I/O cost and make full use of the cluster memory resources.

An Efficient LSM-Tree-Based SQLite-Like Database Engine for Mobile Devices

SQLite has been deployed in millions of mobile devices from Web to smartphone applications on various mobile operating systems. However, due to the uncoordinated IO interactions with the underlying file system (e.g., ext4), SQLite is not efficient with low transactions per second. In this paper, we for the first time propose a new SQLite-like database engine, called SQLiteKV, which adopts the LSM-tree-based data structure but retains the SQLite operation interfaces. With its SQLite interface, SQLiteKV can be utilized by existing applications without any modification, while providing high performance with its LSM-tree-based data structure. We separate SQLiteKV into the front-end and back-end. In the front-end, we develop a light-weight SQLite-to-KV compiler to solve the semantic mismatch, so SQL statements can be efficiently translated into KV operations. We also design a novel coordination caching mechanism with memory defragmentation so query results can be effectively cached inside SQLiteKV by alleviating the discrepancy of data management between front-end SQLite statements and back-end data organization. In the back-end, we adopt an LSM-tree-based key-value database engine, and propose a lightweight metadata management scheme to mitigate the memory requirement. We have implemented and deployed SQLiteKV on a Google Nexus 6P smartphone. Experimental results with various workloads show that SQLiteKV outperforms SQLite up to six times.

SDFS: A software‐defined file system for multitenant cloud storage

SummaryPerformance isolation is highly desirable in cloud platforms where the virtual disks of virtual machines are simply large files on the shared and networked storage servers. However, existing isolation techniques cannot deal with the implications of the file system used by the networked storage servers, such that underlying resource usage is unpredictable (eg, the delayed write‐back mechanism could postpone writes, and the journaling mechanism could amplify writes). The lack of visibility on underlying resource usage leads to the predicament of being unable to meet isolation goals. In this paper, we present a software‐defined file system (SDFS) that exploits the underlying file system to allocate resources at per‐image‐file granularity and provide tenants with guaranteed throughput. The SDFS comprises two components: control plane and data plane. At the control plane, we provide a set of system calls to document tenant performance requirements into the metadata of image files. At the data plane, we construct a file‐based scheduler to manage memory and disk resources according to the tenant performance requirements. The SDFS design does not require a modification to guest operating systems, hypervisors, or file server protocols. Through a prototype implementation, we demonstrate that the SDFS can meet isolation goals and increase resource utilization with negligible overhead.

Optimizing Erasure-Coded Data Archival for Replica-Based Storage Clusters

For the sake of cost-effectiveness, it is a conventional wisdom to employ (k + r,k) erasure codes to archive rarely accessed replicas, i.e. erasure-coded data archival. Existing researches on erasure-coded data archival optimizations are mainly aimed to reduce archival traffic within storage clusters. Apart from archival traffic, both non-sequential reads and imbalanced loads can deteriorate archival performance. Traditional distributed archival schemes (DArch for short) for randomly distributed replicas tend to suffer from two problems: (i) non-sequential reads because underlying file systems split a data block into multiple smaller data chunks and (ii) imbalanced loads since archival tasks are assigned according to data locality of replicas. To overcome such drawbacks, we incorporate both prefetching mechanism and balancing strategy into erasure-coded archival for replica-based storage clusters, and propose three new archival schemes: a prefetching-enabled archival scheme (i.e. P-DArch), a balancing-enabled archival scheme (i.e. B-DArch) and a prefetching-and-balancing-enabled archival scheme (i.e. PB-DArch). We implement a proof-of-concept prototype, where all the four archival schemes are deployed and quantitatively evaluated. The experimental results show that both the prefetching mechanism and balancing strategy can effectively optimize archival performance of a replica-based storage cluster exhibiting a random data layout. In a (12,9) RS-coded archival scenario, P-DArch, B-DArch and PB-DArch outperform DArch by a factor of 2.95, 1.72 and 3.85, respectively.

SADUS: Secure data deletion in user space for mobile devices

Conventional data deletion is implemented for reclaiming storage as a rapid operation. However, the content of the deleted file still persists on the storage medium. Secure data deletion is a task of deleting data irrecoverably from the physical medium. Mobile devices use flash memory as the internal storage. However, flash memory does not support the in-place update which is in direct opposition to efforts to securely delete sensitive data from storage. Previously practical secure deletion tools and techniques are rapidly becoming obsolete, and are rendered ineffective. Therefore, research on secure data deletion approaches for mobile devices has become a practical and urgent issue.In this paper, we study the logic structure and operation characteristics of flash memory, and survey related work on secure data deletion. In addition, we define the adversary capability and threat model, putting forward the design goals that secure data deletion scheme needs to meet. Then an approach in user space that uses the user space file system to provide secure deletion guarantees at file granularity is proposed, independent of the characteristics of the underlying file system and storage medium. The approach encrypting every file on an insecure medium with a unique key that can later be discarded to cryptographically render the data irrecoverable. Moreover, we implement our secure data deletion approach on Android platform named SADUS. Finally, experiments are conducted, and the results indicate that SADUS prototype ensures the secure deletion of data in flash memory on mobile devices with comparable overhead and it can meet the requirements of the users in daily use.

LibreKV: A Persistent In-Memory Key-Value Store

Emerging Non-Volatile Memory (NVM) possesses unique features including byte-addressability and high density which bring huge opportunities to combine DRAM and NVM in a unified main memory space. And key-value store (KVS) systems play an important role in many applications, such as large-scale websites. Several existing KVS have been proposed for NVMs. However, they have drawbacks such as extra write overhead leading, lower memory utilization and worse endurance. In this paper, we design and develop an NVM-based key-value store system named LibreKV. It specifically targets the hybrid DRAM and NVM memory architecture, leveraging the NVM as the eventual persistent storage medium. It uses both static hash table and dynamic hash tables to achieve a balance between system performance and memory utilization. It adopts a checksum based consistency mechanism to guarantee data consistency and persistent storage on NVM. LibreKV works independently without relying on an underlying file system and simplified the IO stack comparing to the traditional KVS system. Experimental results show that LibreKV outperforms the state-of-the-art KVS systems and achieves better scalability and consistency while with low overhead.

Hybrid row-column partitioning in teradata ®

Data partitioning is an indispensable ingredient of database systems due to the performance improvement it can bring to any given mixed workload. Data can be partitioned horizontally or vertically. While some commercial proprietary and open source database systems have one flavor or mixed flavors of these partitioning forms, Teradata Database offers a unique hybrid row-column store solution that seamlessly combines both of these partitioning schemes. The key feature of this hybrid solution is that either row, column, or combined partitions are all stored and handled in the same way internally by the underlying file system storage layer. In this paper, we present the main characteristics and explain the implementation approach of Teradata's row-column store. We also discuss query optimization techniques applicable specifically to partitioned tables. Furthermore, we present a performance study that demonstrates how different partitioning options impact the performance of various queries.

Enhancement of cooperation between file systems and applications — on VFS extensions for optimized performance

Modern operating systems incorporate an abstract layer called Virtual File System (VFS), which is positioned between user applications and real file systems to hide the differences of various file systems and to expose generic application interfaces for requesting file system services. However, VFS sometimes does not give applications an opportunity to pass information to file systems to help them make correct optimization decisions. In this paper, we review the Linux VFS, discuss its deficiencies and propose several extensions to allow applications to cooperate with the file systems more efficiently. We introduce simple prefetching interfaces and advisory flags to allow applications to communicate application-related semantics to VFS and/or the underlying file systems. These suggestions, which neither affect the semantics of applications nor modify their programming models, not only lead to simple VFS/file systems but also guide them to make correct performance-related decisions, if required. We demonstrate that these interfaces and flags are also easy to implement and can boost application performance by up to 4.29X.

Locality-aware allocation of multi-dimensional correlated files on the cloud platform

The effective management of enormous data volumes on the Cloud platform has attracted devoting research efforts. In this paper, we study the problem of allocating files with multidimensional correlations on the Cloud platform, such that files can be retrieved and processed more efficiently. Currently, most prevailing Cloud file systems allocate data following the principles of fault tolerance and availability, while inter-file correlations, i.e. files correlated with each other, are often neglected. As a matter of fact, data files are commonly correlated in various ways in real practices. And correlated files are most likely to be involved in the same computation process. Therefore, it raises a new challenge of allocating files with multi-dimensional correlations with the "subspace locality" taken into consideration to improve the system throughput. We propose two allocation methods for multi-dimensional correlated files stored on the Cloud platform, such that the I/O efficiency and data access locality are improved in the MapReduce processing paradigm, without hurting the fault tolerance and availability properties of the underlying file systems. Different from the techniques proposed in [1,2], which quickly map the locations of desired data for a given query $${\mathcal {Q}}$$Q, we focus on improving the system throughput for batch jobs over correlated data files. We clearly formulate the problem and study a series of solutions on HDFS [9]. Evaluations with real application scenarios prove the effectiveness of our proposals: significant I/O and network costs can be saved during the data retrieval and processing. Especially for batch OLAP jobs, our solution demonstrates well balanced workload among distributed computing nodes.

Shield: A stackable secure storage system for file sharing in public storage

With the increasing amount of personal data stored in public storage, users are losing control of their physical data, putting their data information at risk of theft or being compromised. Traditional secure storage systems either require users to completely trust the storage provider or impose the considerable burden of managing files on file owners; such systems are inapplicable in the practical cloud environment. This paper addresses these challenging problems by proposing a new secure system architecture and implementing a stackable secure storage system named Shield, in which a proxy server is introduced to be in charge of authentication and access control. We propose a new variant of the Merkle Hash Tree to support efficient integrity checking and file content update; further, we have designed a hierarchical key organization to achieve convenient keys management and efficient permission revocation. Shield supports concurrent write access by employing a virtual linked list; it also provides secure file sharing without any modification to the underlying file systems. A series of evaluations over various real benchmarks show that Shield causes about 7%∼13% performance degradation when compared with eCryptfs but provides enhanced security for user’s data.

Optimizing I/O forwarding techniques for extreme-scale event tracing

Programming development tools are a vital component for understanding the behavior of parallel applications. Event tracing is a principal ingredient to these tools, but new and serious challenges place event tracing at risk on extreme-scale machines. As the quantity of captured events increases with concurrency, the additional data can overload the parallel file system and perturb the application being observed. In this work we present a solution for event tracing on extreme-scale machines. We enhance an I/O forwarding software layer to aggregate and reorganize log data prior to writing to the storage system, significantly reducing the burden on the underlying file system. Furthermore, we introduce a sophisticated write buffering capability to limit the impact. To validate the approach, we employ the Vampir tracing toolset using these new capabilities. Our results demonstrate that the approach increases the maximum traced application size by a factor of 5× to more than 200,000 processes.

Software Design and Implementation for MapReduce across Distributed Data Centers

Recently, the computational requirements for large-scale data-intensive analysis of scientific data have grown significantly. In High Energy Physics (HEP) for example, the Large Hadron Collider (LHC) produced 13 petabytes of data in 2010. This huge amount of data are processed on more than 140 computing centers distributed across 34 countries. The MapReduce paradigm has emerged as a highly successful programming model for large-scale data-intensive computing applications. However, current MapReduce implementations are developed to operate on single cluster environments and cannot be leveraged for large-scale distributed data processing across multiple clusters. On the other hand, workflow systems are used for distributed data processing across data centers. It has been reported that the workflow paradigm has some limitations for distributed data processing, such as reliability and efficiency. In this paper, we present the design and implementation of G-Hadoop, a MapReduce framework that aims to enable large-scale distributed computing across multiple clusters. G-Hadoop uses the Gfarm file system as an underlying file system and executes MapReduce tasks across distributed clusters.

Distinct Sector Hashes for Target File Detection

Using an alternative approach to traditional file hashing, digital forensic investigators can hash individually sampled subject drives on sector boundaries and then check these hashes against a prebuilt database, making it possible to process raw media without reference to the underlying file system.

FARM: file annotation and retrieval on mobile devices

As the technology evolves, mobile phones and portable devices are equipped with advanced features like built-in cameras, audio/video recordings, and other applications. When a user starts utilizing such features and applications, usually a large number of files are generated, and as this number grows, it becomes a challenging task to find the requested files with limited user-interface capabilities. This article presents FARM, a framework for file annotation and retrieval on resource-limited mobile devices like mobile phones, PDAs, and other MIDP compliant devices. Once the annotation process is completed, user can easily retrieve the files on the device itself or on in a networked environment where a large number of mobile nodes are involved. The metadata for annotation is gathered from the underlying file system and stored locally, which gives this framework a two-fold gain. Firstly, this framework does not require any common repository and hence, does not require communication medium to store and retrieve metadata. Secondly, searches are performed in a distributed fashion when more than one device is searched. The proposed framework has been implemented with a full featured application, and experimental results show that files can be retrieved efficiently and accurately with annotated data.

Design and Evaluation of MPI File Domain Partitioning Methods under Extent-Based File Locking Protocol

MPI collective I/O has been an effective method for parallel shared-file access and maintaining the canonical orders of structured data in files. Its implementation commonly uses a two-phase I/O strategy that partitions a file into disjoint file domains, assigns each domain to a unique process, redistributes the I/O data based on their locations in the domains, and has each process perform I/O for the assigned domain. The partitioning quality determines the maximal performance achievable by the underlying file system, as the shared-file I/O has long been impeded by the cost of file system's data consistency control, particularly due to the conflicted locks. This paper proposes a few file domain partitioning methods designed to reduce lock conflicts under the extent-based file locking protocol. Experiments from four I/O benchmarks on the IBM GPFS and Lustre parallel file systems show that the partitioning method producing minimum lock conflicts wins the highest performance. The benefit of removing conflicted locks can be so significant that more than thirty times of write bandwidth differences are observed between the best and worst methods.