Research On Reconstructing YAFFS2Files From NAND Flash Images

With the extensive application of embedded equipment, data recovering from NAND flash gain more and more importance. Compared with magnetic storage medium, the NAND flash has two main differences. Firstly, from the hardware aspect, NAND is much less written-endurable and abides by the principle of "out-of-place write". Secondly, from the software aspect, file systemsdeployed on NAND flash adopt different approaches to implement mechanisms like "block allocation","wear-leveling","garbage collection" etc. These physical and logical specifics make recovering files from NAND flash by traditional method a difficult thing, thus how to recover files from NAND flash becomes a tricky problem. Nowadays, phones with Android operating system have a large market share,to the knowledge of us, the internal memory of an Android smart phone is a NAND flash chip using YAFFS2to store and manage data. The aim of this dissertation is to reconstruct files and their traces from NAND flash images.The main work of this paper can be divided into two parts.Firstly, this paper proposes a method to recover files from Android internal memory image. Since information which indicates the relationship among data is stored in spare area of NAND flash by YAFFS2, and the storage space of NAND are always allocated sequentially, a method to scan the whole image reversely in chronological order and reconstruct files is proposed.The simulated experiment results under Linux operating system and the real android internal memory images show the efficiency of our method.Secondly, on the basic of the method proposed above, this paper does further research to reconstruct file traces from NAND image. There is an important principle in YAFFS2that every object header indicates a file version. According to this, we scan the whole image reversely in chronological order, find all the object headers and reconstruct different versions. Experiments conducted under Linux operating system prove the proposed algorithm is effective. In summary, the paper proves that it is feasible to reconstruct files and traces from NAND flash image based on YAFFS2metadata.