RecuperaBit icon indicating copy to clipboard operation
RecuperaBit copied to clipboard

Add support for Ext4

Open Lazza opened this issue 7 years ago • 0 comments

Dewald and Seufert describe an approach that can be used to reconstruct Ext4 file systems even if the metadata is damaged: Andreas Dewald, Sabine Seufert, AFEIC: Advanced forensic Ext4 inode carving, Digital Investigation, Volume 20, Supplement, March 2017, Pages S83-S91, ISSN 1742-2876.

Their approach seems to have some similarities to the NTFS module of RecuperaBit:

[We] develop a novel approach to identify files in an Ext4 file system even in cases where the superblock is corrupted or overwritten, e.g. because of a re-formatting of the volume. Our approach applies heuristic search patterns for utilizing methods of file carving and combines them with metadata analysis.

The paper (full text) should be carefully studied to verify if this approach can be turned into a RecuperaBit plug-in.

Lazza avatar Apr 23 '17 20:04 Lazza