一种基于闪存物理镜像的FAT文件系统重组方法

doi:10.3969/j.issn.0372-2112.2013.08.006

电子学报 ›› 2013, Vol. 41 ›› Issue (8): 1487-1493.DOI: 10.3969/j.issn.0372-2112.2013.08.006

一种基于闪存物理镜像的FAT文件系统重组方法

张丽^1,2, 谭毓安^1,3, 郑军^1,3, 马忠梅¹, 王文明¹, 李元章¹

1. 北京理工大学计算机学院, 北京 100081;
2. 南阳师范学院计算机与信息技术学院, 河南南阳 473061;
3. 北京理工大学北京市海量信息处理与云计算应用工程技术中心, 北京 100081

收稿日期:2012-09-10 修回日期:2013-01-31 出版日期:2013-08-25
- 通讯作者:
- 郑军
- 作者简介:
- 张丽 女,1978年出生,河南南阳人.1997年、2001年分别在河南师范大学、湖南大学获理学学士和工学硕士学位,现为在读博士生,从事数字取证、嵌入式系统等有关研究. E-mail:hnnyzli@bit.edu.cn 谭毓安 男,1972年出生,重庆巫溪人.教授、博士生导师.现主要从事为信息安全、嵌入式系统等方面的研究工作. E-mail:tan2008@bit.edu.cn
- 基金资助:
- 国家863高技术研究发展计划 (No.2013AA01A212)

A Method for Reconstructing the FAT File System from Flash Memory

ZHANG Li^1,2, TAN Yu-an^1,3, ZHENG Jun^1,3, MA Zhong-mei¹, WANG Wen-ming¹, LI Yuan-zhang¹

1. School of Computer Science and Technology, Beijing Institute of Technology, Beijing 100081, China;
2. Department of Computer and Information Technology, Nanyang Normal University, Nanyang, Henan 473061, China;
3. Beijing Engineering Research Center of High Volume Language Information Processing and Cloud Computing Application, Beijing Institute of Technology, Beijing 100081, China

Received:2012-09-10 Revised:2013-01-31 Online:2013-08-25 Published:2013-08-25
- Supported by:
- National High-tech R&D Program of China (863 Program) (No.2013AA01A212)

摘要/Abstract

摘要： 文件系统重组是闪存设备取证研究进行数据恢复的主要手段.传统的文件系统重组方法需要同时获取闪存设备在同一时刻的逻辑镜像和物理镜像,该条件在取证实践中常常难以满足,故提出一种仅依赖闪存物理镜像重组文件分配表(FAT)文件系统的方法.在引入统计分析法从物理镜像中提取逻辑地址字段和页状态字段的基础上,给出利用最新页状态值准确重组闪存设备最新FAT文件系统镜像的算法.最后以MTK6229闪存设备物理镜像的FAT文件系统重组过程为例,验证上述重组算法及相关方法是正确的.

关键词: 数字取证, 闪存, 物理镜像, 文件系统重组, 空闲区

Abstract: The file system reconstruction is an effective way of recovering the forensic data from Flash memory.However,the traditional reconstruction methods need a precondition that is there are both the logical image and the physical image of flash memory at the same time and that is usually not satisfied in practice.In this paper,we propose a method for reconstructing the File Allocation Table (FAT) file system of Flash device when only a physical image of Flash memory is acquired.After introducing the statistical methods to identify the logical address bytes and the page state byte from the physical image,we propose the new algorithm to reconstruct the newest FAT file system which is based on the newest value of the page state.At last,take the special flash devices with MTK6229 controllers as examples,we expound the methods related to reconstructing the FAT file system and verify the reconstruction algorithm.

Key words: digital forensics, flash memory, physical image, file system reconstruction, spare area

中图分类号:

TP309.3

张丽, 谭毓安, 郑军, 等. 一种基于闪存物理镜像的FAT文件系统重组方法[J]. 电子学报, 2013, 41(8): 1487-1493.

ZHANG Li, TAN Yu-an, ZHENG Jun, et al. A Method for Reconstructing the FAT File System from Flash Memory[J]. Acta Electronica Sinica, 2013, 41(8): 1487-1493.

参考文献

[1] 许榕生.我国数字取证技术研究的十年回顾[J].计算机安全,2011,3:17-19. Xu Rongsheng.Decade review of digital forensic research[J].Computer Security,2011,3:17-19.(in Chinese)
[2] 丁丽萍,王永吉.计算机取证的相关法律技术问题研究[J].软件学报,2005,16(2):260-273. Ding Liping,Wang Yongji.Study on relevant law and technology issues about computer forensics[J].Journal of Software,2005,16(2):260-273.(in Chinese)
[3] 陈龙,娄晓会,王国胤.基于有限射影几何的细粒度数据完整性检验方法[J].电子学报,2011,39(12):2850-2855. Chen Long,Lou Xiaohui,Wang Guoyin.An integrity check method for fine-grained data based on finite projective geometry[J].Acta Electronica Sinica,2011,39(12):2850-2855.(in Chinese)
[4] 孙国梓,耿伟明,陈丹伟,申涛.基于可信概率的电子数据取证有效性模型[J].计算机学报,2011,34(7):1262-1274. Sun Guozi,Geng Weiming,Chen Danwei,Shen Tao.One validity model of digital data forensics based on trusted probability.Chinese Journal of Computers,2011,34(7):1262-1274.(in Chinese)
[5] 王文奇,苗凤君,潘磊,张书钦.网络取证完整性技术研究[J].电子学报,2010,38(11):2529-2534. Wang Wenqi,Miao Fengjun,Pan Lei,Zhang Shuqin.The research on integrity of network-based forensic[J].Acta Electronica Sinica,2010,38(11):2529-2534.(in Chinese)
[6] 钟巍,孔祥维,尤新刚,王波.基于态函数的离散分数余弦倒谱变换在取证话音信息隐藏中的应用[J].电子学报,2012,40(3):595-599. Zhong Wei,Kong Xiangwei,You Xingang,Wang Bo.Forensic speech information hiding using fractional cosine-cepstrum transform[J].Acta Electronica Sinica,2012,40(3):595-599.(in Chinese)
[7] Shafik G,Punja,Richard P.Mislan.Mobile device analysis[J].Small Scale Digital Device Forensics Journal,2010,2(1):1-15.
[8] Vrizlynn L L Thing,Kian-Yong Ng,Ee-Chien Chang.Live memory forensics of mobile phones[J].Digital Investigation,2010,7(1):74-82.
[9] 易凌鹰.基于闪存数据恢复的计算机取证技术的研究与实现[D].北京:北京邮电大学硕士学位论文,2009,6. Yi Lingying.Research and implementation of computer forensics technology based on data recovery from flash memory[D].Beijing:Beijing University of Post and Telecommunications of China,2009,6.(in Chinese)
[10] Marcel B,Martien DJ.Forensic data recovery from flash memory[J].Small Scale Digital Device Forensic,2007,1(1):1-17.
[11] C.Klaver.Windows mobile advanced forensics[J].Journal of Digital Investigation,2010,6:147-167.
[12] 肖腾,许榕生.基于差异度的JPEG碎片重组方法[J].计算机工程,2011,37(10):263-265. Xiao Teng,Xu Rongsheng.Reassembling method for JPEG fragment based on degree of difference[J].Computer Engineering,2011,37(10):263-265.(in Chinese)
[13] Scott Hand,Zhiqiang Lin,Guofei Gu etc.Bin-carver:automatic recovery of binary executable files[J].Digital Investigation,2012,9:s108-s117.
[14] 时正,纪金松,陈香兰,等.一种基于差分进化的Flash文件系统垃圾回收算法[J].电子学报,2011,39(2):280-284. Shi Zheng,Ji Jin-song,Chen Xiang-lan,Gong Yu-chang.A garbage collection algorithm for flash file system based on differential evolution[J].Acta Electronica Sinica,2011,39(2):280-284.(in Chinese).
[15] Shiffler R E.Maximum Z score and outliers[J].The American Statistician,1988,42(1):79-80.
[16] Steven J P.Intermediate Statistics:A Modern Approach[M].Hillsdale,New Jersey:Lawrence Erlbaum Associates,1990.456-502.

一种基于闪存物理镜像的FAT文件系统重组方法

A Method for Reconstructing the FAT File System from Flash Memory

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 3

编辑推荐

Metrics

[1]	陈珂, 杜智超, 叶松, 王颀, 霍宗亮. 基于一种NAND闪存页缓存器设计的C/F读取算法研究[J]. 电子学报, 2018, 46(11): 2619-2625.
[2]	郭家荣, 冉峰, 徐美华. 基于电阻电流镜的低压灵敏放大器设计[J]. 电子学报, 2014, 42(5): 1030-1034.
[3]	周琳娜;王东明;郭云彪;杨义先. 基于数字图像边缘特性的形态学滤波取证技术[J]. 电子学报, 2008, 36(6): 1047-1051.