Digging Up the Past: Reconstructing File Operation History from Ext4 and XFS Journals
summary
Reconstructs file operation histories by parsing filesystem journals from ext4 and XFS. Describes techniques and tooling to extract and interpret journal records so past file creations, deletions, and modifications can be recovered from those filesystems' on-disk journal structures.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 6:44Filesystem journal basics
- 11:15EXT4 journal analysis
- 16:09XFS journal analysis
- 21:05Reconstructing file activity
- 26:19FJTA tool demo
- 30:57Journal forensic limits
- 35:17Summary and future work
- 36:40Q&A
related talks
20mA Powerful Logs Management Solution We All Have and Use but...
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
23mTracking Files across the operating system using eBPF
27mFrom Dead Data to Digestion: Extracting Windows Fibers for Your Digital Forensics Diet
26mDive into Apple UserFS (Userspace Filesystem)
23mTopics of Interest: Five philosophies to building better application logs
15mUncovering the History of Your Software Artifacts
33mEncryption for filesystems with advanced features new fscrypt functionality