Fraunhofer-Gesellschaft

Publica

Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Forensic analysis of multiple device BTRFS configurations using The Sleuth Kit

 
: Hilgert, Jan-Niclas; Lambertz, Martin; Yang, Shuijan

:
Volltext ()

Digital Investigation 26 (2018), Supplement, S.S21-S29
ISSN: 1742-2876
ISSN: 1873-202X
Digital Forensics Research Conference (DFRWS) <18, 2018, Providence/RI>
Englisch
Zeitschriftenaufsatz, Konferenzbeitrag, Elektronische Publikation
Fraunhofer FKIE ()

Abstract
The analysis of file systems is a fundamental step in every forensic investigation. Long-known file systems such as FAT, NTFS, or the ext family are well supported by commercial and open source forensics tools. When it comes to more recent file systems with technologically advanced features, however, most tools fall short of being able to provide an investigator with means to perform a proper forensic analysis.
BTRFS is such a file system which has not received the attention it should have. Although introduced in 2007, marked as stable in 2014, and being the default file system in certain Linux distributions, there is virtually no research available in the area of digital forensics when it comes to BTRFS; nor are there any software tools capable of analyzing a BTRFS file system in a way required for a forensic analysis.
In this paper we add support for BTRFS—including support for multiple device configurations—to The Sleuth Kit, a widely used toolkit when it comes to open source file system forensics. Moreover, we provide an analysis of forensically important features of BTRFS and show how our implementation can be used to utilize these during a forensic analysis.

: http://publica.fraunhofer.de/dokumente/N-531816.html