Forensic analysis techniques for fragmented flash memory pages in smartphones

Digital Investigation

Volumn 9, Issue 2, 2012, Pages 109-118

  Park, Jungheum ^a   Chung, Hyunji ^a   Lee, Sangjin ^a  

^a Korea University   (South Korea)

Author keywords

Digital forensics; Flash memory; Fragmented data; Smartphone forensics; Unallocated area

Indexed keywords

CELLULAR TELEPHONE SYSTEMS; COMPUTER CRIME; DATA ACQUISITION; DIGITAL FORENSICS; ELECTRONIC CRIME COUNTERMEASURES; FILE ORGANIZATION; IMAGE ACQUISITION; IMAGE ANALYSIS; IMAGE PROCESSING; INFORMATION DISSEMINATION; SIGNAL ENCODING; SMARTPHONES; TELEPHONE SETS;

ANALYSIS TECHNIQUES; DEBUGGING FUNCTIONS; FORENSIC INVESTIGATION; FRAGMENTED DATA; MOBILE APPLICATIONS; PERSONAL INFORMATION; SMARTPHONE FORENSICS; UNALLOCATED AREA;

FLASH MEMORY;

EID: 84870255379     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2012.09.003     Document Type: Article

References (20)

1. Adroit Photo Forensics. http://digital-assembly.com/products/adroit- photo-forensics/; 2011.
2. J. Bédrune, and J. Sigwald iphone data protection http://code.google.com/p/iphone-dataprotection/
3. R. Brown Reconstructing corrupt DEFLATEd files Digital Investigation 8 2011 S125 S131
4. DC1743 (Sausage Factory) An analysis of the record structure within SQLite databases http://forensicsfromthesausagefactory.blogspot.com/2011/05/ analysis-of-record-structure-within.html 2011
5. DFRWS 2011 forensics challenge http://www.dfrws.org/2011/challenge/ 2011
6. S. Garfinkel Digital media triage with stream-based forensics and bulk extractor http://afflib.org/software/bulk-extractor 2011
7. S. Jeon, J. Bang, K. Byun, and S. Lee A recovery method of deleted record for SQLite database Personal and Ubiquitous Computing 16 2012 707 715
8. C. King, and T. Vidas Empirical analysis of solid state disk data retention when used with contemporary operating systems Digital Investigation 8 2011 S111 S117
9. C. Klaver Windows mobile advanced forensics Digital Investigation 6 2010 147 167
10. D.E. Knuth Seminumerical algorithms The art of computer programming vol. 2 1997 Addison-Wesley
11. Memory technology device http://www.linux-mtd.infradead.org
12. Netherlands Forensic Institute NFI defraser http://defraser.sourceforge. net/
13. I. Pooters, P. Arends, and S. Moorrees (Fox-IT) Extracting SQLite records - carving, parsing and matching http://www.dfrws.org/2011/challenge/results. shtml 2011
14. Samsung Electronics Co., Ltd. LinuStoreii Samsung Onenand Flash Linux device driver - GPL compliance; 2008.
15. Samsung Electronics Co., Ltd. eMMC http://www.samsung.com/global/ business/semiconductor/product/flashemmc/overview
16. H. Sencar, and N. Memon Identification and recovery of JPEG files with missing fragments Digital Investigation 6 2009 S88 S98
17. SQLite database file format http://www.sqlite.org/fileformat2.html
18. Wei M, Grupp L, Spada F, Swanson S. Reliably erasing data from flash-based solid state drives. In: FAST 2011 (9th USENIX conference on file and storage technologies); Feb. 2011.
19. D. Woodhouse, and S. Hill nanddump: dumps the contents of raw NAND chips or NAND chips http://git.infradead.org/mtd-utils.git/blob-plain/HEAD:/nanddump.c 2000
20. YAFFS (Yet Another Flash File System). http://www.yaffs.net.