Btrfs Forensic Analysis

مقدم أطروحة جامعية

Hraiz, Safa Fawzi

مشرف أطروحة جامعية

al-Sarhan, Sami

أعضاء اللجنة

Qasaimih, Malik
Awad, Imad al-Din

الجامعة

جامعة الأميرة سمية للتكنولوجيا

الكلية

كلية الملك الحسين لعلوم الحوسبة

دولة الجامعة

الأردن

الدرجة العلمية

ماجستير

تاريخ الدرجة العلمية

2016

الملخص الإنجليزي

The investigators in any crimes try to find the evidence, and in cybercrime the investigators do the same thing.

The investigators of cybercrimes usually start by checking the OS layer for evidences, failing at such layer, will lead to checks at a lower layer “file system”.

This means that the investigators should have a good understanding of the file system they want to deal with.

Btrfs is a new file system developed by Chris Mason in 2007.

Btrfs is developed in order to be the next major file system.

Btrfs provides a number of features that make it a very attractive file system solution for many use cases and workloads.

Despite that many researches aimed to discover the behavior of different file systems from a forensic perspective, none of them has considered Btrfs.

This thesis comes to highlight the actual behavior of Btrfs file system, provide an insight to the used data structures, and show how investigators could investigate and extract digital evidences properly from a Btrfs file system.

This thesis has focused on the basic file system operations including creating a file and directory, modifying the content of the file, renaming a file, copying a file, moving a file, and finally deleting a file.

Also, it has discovered the changes of the timestamps of the files and directories.

It has shown when these times change and also it has shown which operation changes which timestamps.

Finally, this thesis will be the reference for the researchers who want to study data recovery and anti-forensic (ex: hidden data) techniques that could be applied to the Btrfs file system.

التخصصات الرئيسية

تكنولوجيا المعلومات وعلم الحاسوب

عدد الصفحات

121

قائمة المحتويات

• APA
• MLA
• AMA

لغة النص

الإنجليزية

نوع البيانات

رسائل جامعية

رقم السجل

BIM-720860