Zettabyte File System Autopsy: Digital Crime Scene Investigation for ...

More documents

Recommendations

Info

Our new ZDB extension � Retrieve the active ZFS uberblock and block pointer � Retrieve the dnode <strong>for</strong> the metadata object set � Retrieve the Object Directory dnode and its ZAP object � Retrieve the DSL Directory object � Retrieve the DSL Dataset object � Using the DSL Dataset dnode, retrieve the ZFS file system object set � Using the ZFS file system object, get the Master dnode and its ZAP object � From the ZAP object of the Master dnode, get the root directory dnode of the ZFS file system � From the block pointer of the root directory, find the object id of our target file � Using the address stored in the object id dnode, retrieve the block of data directly from the disk and output the raw data. NEW ZDB FEATURE – our new ZDB extension 20
Summary � In summary, our new ZDB travels through layers of the ZFS file system to search <strong>for</strong> the target data stored on disk. � ZDB grabs a chuck of data directly from the disk without invoking the file system of the operating system NEW ZDB FEATURE– Summary 21
Page 1 and 2: Digital Crime Scene Investigation f
Page 3 and 4: Topic Outline � Introduction �
Page 5 and 6: File System Basics � Computer sto
Page 7 and 8: Difficulties in file system forensi
Page 9 and 10: FILE SYSTEMS IN UNIX
Page 11 and 12: Inode FILE SYSTEMS - INODE 11
Page 13 and 14: ZFS
Page 15 and 16: Deleting a file in ZFS unlink() ->
Page 17 and 18: ZFS Basics � Virtual Device (vdev
Page 19: NEW ZDB FEATURE

Zettabyte File System Autopsy: Digital Crime Scene Investigation for ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?