Reverse Engineering of the Android File System

[Nytro]

Reverse Engineering of the Android File System

Sven Schmitt, Michael Spreitzenbarth, Christian Zimmermann

Security Research Group

Dept. of Computer Science, University of Erlangen, Germany

www1.informatik.uni-erlangen.de

Abstract—YAFFS2 is a file system which is used in

many modern smartphones. Allthough YAFFS2 is an open

standard and there exists an open source implementation,

the behavior of YAFFS2 is not very well understood. Additionally,

several aspects like wear-leveling and garbagecollection

are not well-specified in the standard so that

their actual behavior has to be reverse engineered from

the implementation. Here, we give an introduction to and

describe the basic functionality of YAFFS2. We place a

particular focus on the detailed analysis of both wearleveling

and garbage-collection mechanisms, since these are

important within a forensic analysis of the file system.

Index Terms—smartphones; forensics; Android;

YAFFS2, garbage-collection

Download:

http://www.opus.ub.uni-erlangen.de/opus/volltexte/2011/2833/pdf/CS_2011_06.pdf

Edited November 28, 2011 by Nytro

[l34k]

Mai baga o fisa

Pare promitator articolul.

[Nytro]

Am reparat. Da, e foarte detaliat si bine organizat.