Forensic Analysis of the Resilient File System (ReFS) Version 3.4

Please always quote using this URN: urn:nbn:de:bvb:29-opus4-125260
  • ReFS is a modern file system that is developed by Microsoft and its internal structures and behavior is not officially documented. Even so there exist some analysis efforts in deciphering its data structures, some of these findings have yet become deprecated and cannot be applied to current ReFS versions anymore. In this work, general concepts and internal structures found in ReFS are examined and documented. Based on the structures and the processes by which they are modified, approaches to recover (deleted) files from ReFS formatted file systems are shown. We also evaluated our implementation and the allocation strategy of ReFS with respect to accuracy, runtime and the ability to recoverReFS is a modern file system that is developed by Microsoft and its internal structures and behavior is not officially documented. Even so there exist some analysis efforts in deciphering its data structures, some of these findings have yet become deprecated and cannot be applied to current ReFS versions anymore. In this work, general concepts and internal structures found in ReFS are examined and documented. Based on the structures and the processes by which they are modified, approaches to recover (deleted) files from ReFS formatted file systems are shown. We also evaluated our implementation and the allocation strategy of ReFS with respect to accuracy, runtime and the ability to recover older file states. In addition, we extended The Sleuth Kit allowing it to parse ReFS partitions and build a carver based on that extend The Sleuth Kit.show moreshow less

Download full text files

Export metadata

Additional Services

Share in Twitter Search Google Scholar Statistics
Metadaten
Author:Paul Prade, Tobias Groß, Andreas Dewald
Persistent identifiers - URN:urn:nbn:de:bvb:29-opus4-125260
Persistent identifiers - DOI:https://doi.org/10.25593/issn.2191-5008/CS-2019-05
ISSN:2191-5008
Series (Volume number):Technical reports / Department Informatik (CS-2019-05)
Document Type:Report
Language:English
Year of publication:2019
Date of online publication (Embargo Date):2019/12/06
Publishing Institution:Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU)
Release Date:2019/12/10
Tag:Data recovery; Digital forensics; File systems; ReFS
Institutes:Technische Fakultät / Department Informatik
Dewey Decimal Classification:0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik
open_access (DINI-Set):open_access
Licence (German):Keine Creative Commons Lizenz - es gilt der Veröffentlichungsvertrag und das deutsche Urheberrecht