File Recovery Method in NTFS-Based Damaged RAID System
- Authors
- Choi, Jong-Hyun; Lee, Sangjin
- Issue Date
- 30-Aug-2022
- Publisher
- KOREA INFORMATION PROCESSING SOC
- Keywords
- Damaged RAID; File Recovery; Striped File; Striped File System
- Citation
- HUMAN-CENTRIC COMPUTING AND INFORMATION SCIENCES, v.12
- Indexed
- SCIE
SCOPUS
- Journal Title
- HUMAN-CENTRIC COMPUTING AND INFORMATION SCIENCES
- Volume
- 12
- URI
- https://scholar.korea.ac.kr/handle/2021.sw.korea/143763
- DOI
- 10.22967/HCIS.2022.12.040
- ISSN
- 2192-1962
- Abstract
- Due to the recent demand for mass storage devices, a redundant array of independent disks (RAID) is used in network-attached storage (NAS), direct-attached storage (DAS), servers, and workstations in addition to laptops and PCs. RAID makes multiple disks into volumes, and alternately stores stripe sizes on member disks. Due to these characteristics, RAID systems create several research issues in digital forensics. One of them, a damaged RAID system, is a case where the RAID configuration information is known, but some member disks are lost. The damaged RAID system has lost some member disks, so it stores a striped filesystem and files when reassembled into volumes. Striped file systems and files are distinctive forms in which data is fragmented within volumes so that meaningful data must be found in the fragmented data. This form is not supported by previous research or other digital forensics tools, and is unknown. In this paper, targeting the NTFS file system, which is the most used file system, we propose and verify a file recovery method from a damaged RAID system by combining RAID reconstruction, file system analysis, striped file system analysis, file carving, and striped file analysis.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - School of Cyber Security > Department of Information Security > 1. Journal Articles
![qrcode](https://api.qrserver.com/v1/create-qr-code/?size=55x55&data=https://scholar.korea.ac.kr/handle/2021.sw.korea/143763)
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.