Earticle

초록

영어

Since High Sierra, APFS has been used as the main file system. It is a well-established file system that has been used stably thus far. From the perspective of digital forensics, there are still many areas to be investigated. Apple File System Reference is provided to the apple developer site, but it is not satisfactory to fully analyze APFS. Researchers know more about the structure of APFS than before, but they have not yet fully analyzed its structure to a perfect level about it. In this paper, we develop APFS object identification tool for digital forensics. The most basic and essential object identification and analysis of the APFS filesystem will be conducted with the tool. The analysis in this study serves as the background for an analysis of the checkpoint operation principle and structure, including the more complex B-tree structure of APFS. There are several options for the developed tool, but the results of two use cases will be shown here. Based on the implemented tool, it is hoped that more functions will be added to make APFS a useful tool for faster and more accurate analyses.

목차

Abstract
1. Introduction
2. Object’s data type
2.1 Object Types
2.2 Object Flags
2.3 Object subtype
2.4 APFS Overall Configuration
3. Configuration of the APFS Object Identification Tool
3.1 Overview
3.2 Development Environments
3.3 Command Line Options
3.4 Experimental Results
5. Conclusions
Acknowledgement
References

키워드

저자

• Gyu-Sang Cho [ Professor, Dept. of Computer&Software, Dongyang University, Korea ] Corresponding author

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Internet, Broadcasting and Communication

• 간기

  계간

• pISSN

  2288-4920

• eISSN

  2288-4939

• 수록기간

  2009~2025

• 십진분류

  KDC 326 DDC 380