Abstract:Most modern digital devices with storage utilize a file system to manage files and directories. Consequently, when digital forensic investigators derive evidence from such devices, they collect and analyze data stored on them through file system analysis. However, there are numerous types of file systems, with new ones continually being developed. Each file system possesses a distinct metadata structure and file management system. Therefore, investigators must possess prior knowledge of the specific file system being examined. Nevertheless, it is challenging for practitioners to be knowledgeable about all existing file systems. To address this issue, forensic software such as The Sleuth Kit (TSK), an open-source forensic tool, is employed for investigations. However, even these tools may not offer complete support for relatively recent file systems. Hence, we propose a structure for integrating a new file system into the open-source forensic tool TSK. Additionally, to validate this proposed structure, we demonstrate that support for five file systems (Ext4, XFS, Btrfs, F2FS, and Hikvision) can be added following this framework. To achieve this, we conducted an analysis of the metadata and file management scheme for these five file systems. Furthermore, we examined the operational procedures of the TSK framework. Based on these analyses, investigation capabilities for the five file systems have been incorporated into TSK. Moreover, reliability verification experiments were conducted on the developed tools; and performance evaluation was carried out in comparison with other commercial digital forensic tools. The findings of this study can serve as a foundation for future forensic studies based on file systems. Additionally, the TSK developed based on the proposed structure can assist investigators in conducting digital forensics effectively.

Computer Forensics Research and Implementation Based on NTFS File System

A Survey of Digital Passive Lossless Forensics on Forged and Altered Document

Automated Event Log File Recovery Based on Content Characters and Internal Structure

Study of Memory Forensics Technology Oriented to Windows Operating System

Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery

Research of Improved Probabilistic Packet Marking Algorithms

Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

Forensic Detection of Timestamp Manipulation for Digital Forensic Investigation

Towards a practical usage for the Sleuth Kit supporting file system add-ons

Data Correlation-Based Analysis Methods for Automatic Memory Forensic

Research and Implementation of New Encrypting File System

A proposed architecture for network forensic system in large-scale networks

Attack Graph Analysis for Network Anti-Forensics.

Research on Effectively Supported Computer Forensic Audit Mechanism

TIFAflow: Enhancing Traffic Archiving System with Flow Granularity for Forensic Analysis in Network Security

TamForen: A Tamper‐proof Cloud Forensic Framework

A Novel Network Forensic Framework for Advanced Persistent Threat Attack Attribution Through Deep Learning

A Dynamic Forensics Model Based on Intrusion Detection System

Graph Matching and Linked List Based Kernel Data Structures Forensic Technology

Cloud Storage Forensics: BaiduNetDisk, WeiYun, and 115yun on a Wireless Network

The Theory and Application of File Deleting