Research On Digital Forensics Based On YAFFS2 File System Metadata

Due to the advancement of technological trends and the improvement of processing capabilities and mobile computing storage space,mobile smart terminals have become people's information processing centers and office assistants,and there are also security issues.With the increasing number of illegal and criminal cases using mobile smart terminals,smart terminal digital forensics technology is needed to combat these crimes.Currently,mainstream digital forensics methods for smart terminals are all based on software and require specific tools or system support.When there are no specific tools or the system cannot be used,these methods will fail.Therefore,there is a need for an intelligent terminal forensics method that does not rely on tools and systems.Among the Android systems used by mainstream mobile smart terminal devices,YAFFS2 file system is the main file system of Android devices.Therefore,this paper studies YAFFS2's digital forensics method.Aiming at the problems of the current smart terminal forensics method,a digital forensics method under the YAFFS2 file system is proposed.This method does not require the support of the operating system and does not require specific tools.This method obtains the file system metadata from the NANDFlash,analyzes the absolute path file name to obtain the object id of the target file,and then searches the chunk of the file through the object id to perform digital forensics on the file.Using the method of this article to experiment,the result is that the chunk of the target file is successfully found.The experimental process proves that the algorithm does not need any tools and system support.The experimental results prove the correctness of the method.Finally,this article summarizes the work of the full text,reflects on the deficiencies of the research,and looks forward to the challenges and opportunities of digital forensics under the YAFFS2 file system.