Earticle

초록

영어

File system forensics typically focus on the contents or timestamps of a file, and it is common to work around file/directory centers. But to recover a deleted file on the disk or use a carving technique to find and connect partial missing content, the evidence must be analyzed using cluster-centered analysis. Forensics tools such as EnCase, TSK, and X-ways, provide a basic ability to get information about disk clusters, but these are not the core functions of the tools. Alternatively, Sysinternals' DiskView tool provides a more intuitive visualization function, which makes it easier to obtain information around disk clusters. In addition, most current tools are for Windows. There are very few forensic analysis tools for MacOS, and furthermore, cluster analysis tools are very rare. In this paper, we developed a tool named FACT (Forensic Analyzer based Cluster Information Tool) for analyzing the state of clusters in a HFS+ file system, for digital forensics. The FACT consists of three features, a Cluster based analysis, B-tree based analysis, and Directory based analysis. The Cluster based analysis is the main feature, and was basically developed for cluster analysis. The FACT tool’s cluster visualization feature plays a central role. The FACT tool was programmed in two programming languages, C/C++ and Python. The core part for analyzing the HFS+ filesystem was programmed in C/C++ and the visualization part is implemented using the Python Tkinter library. The features in this study will evolve into key forensics tools for use in MacOS, and by providing additional GUI capabilities can be very important for cluster-centric forensics analysis.

목차

Abstract
1. Introduction
2. Retrieval of Cluster Information in the HFS+ filesystem
2.1 HFS+ Filesystem Basic
2.2 Catalog File
2.3 Volume Header
2.4 Allocation File
3. Features of FACT(Forensic Analyzer based Cluster Information Tool)
3.1 Overview
3.2 Cluster based Analysis
3.3 B-tree based Analysis
4. Functions for Implementation of FACT
4.1 Overview
4.2 Development Environments
4.3 Implemented functions for FACT core features
4.4 Implemented functions for Cluster Based Analysis
4.5 Implemented functions for B-tree Based Analysis
4.6 Implemented Functions for Directory Based Analysis
4.7 Implemented functions for Display
5. Conclusions
Acknowledgement
References

키워드

저자

• Gyu-Sang Cho [ Professor, Dept. of Computer Software, Dongyang University, Korea ] Corresponding Author

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Internet, Broadcasting and Communication

• 간기

  계간

• pISSN

  2288-4920

• eISSN

  2288-4939

• 수록기간

  2009~2025

• 십진분류

  KDC 326 DDC 380