Seokjun Lee
Current Organizations / Institutes
The organizations/institutes from the scholar's latest article
Research Subjects
Research Interests
Seokjun Lee has a total of 5 co-authors. Here are the top co-authors by number of shared publications:
- Hyungchan Kim
Platform Tech Team, WINS Co., Ltd., Seongnam 13487, Korea
1 shared publication - Sungbum Kim
Department of Artificial Intelligence Convergence Network, Ajou University, Suwon 16499, Korea
1 shared publication - Taeshik Shon
Department of Cyber Security, Ajou University, Suwon, South Korea
1 shared publication - Wooyeon Jo
Department of Computer Engineering, Ajou University, Suwon 16499, Korea
1 shared publication - Yeonghun Shin
Department of Artificial Intelligence Convergence Network, Ajou University, Suwon 16499, Korea
1 shared publication
Latest Publications
- Open Access
- 20 September 2021
- Published by MDPI AG in Electronics
- Vol. 10 (18) , 2310
Ext4 and XFS File System Forensic Framework Based on TSK
Recently, the number of Internet of Things (IoT) devices, such as artificial intelligence (AI) speakers and smartwatches, using a Linux-based file system has increased. Moreover, these devices are connected to the Internet and generate vast amounts of data. To efficiently manage these generated data and improve the processing speed, the function is improved by updating the file system version or using new file systems, such as an Extended File System (XFS), B-tree file system (Btrfs), or Flash-Friendly File System (F2FS). However, in the process of updating the existing file system, the metadata structure may be changed or the analysis of the newly released file system may be insufficient, making it impossible for existing commercial tools to extract and restore deleted files. In an actual forensic investigation, when deleted files become unrecoverable, important clues may be missed, making it difficult to identify the culprit. Accordingly, a framework for extracting and recovering files based on The Sleuth Kit (TSK) is proposed by deriving the metadata changed in Ext4 file system journal checksum v3 and XFS file system v5. Thereafter, by comparing the accuracy and recovery rate of the proposed framework with existing commercial tools using the experimental dataset, we conclude that sustained research on file systems should be conducted from the perspective of forensics.
- 20 September 2021
- Published by MDPI AG in Electronics
- Vol. 10 (18) , 2310
Open AccessExt4 and XFS File System Forensic Framework Based on TSK
Recently, the number of Internet of Things (IoT) devices, such as artificial intelligence (AI) speakers and smartwatches, using a Linux-based file system has increased. Moreover, these devices are connected to the Internet and generate vast amounts of data. To efficiently manage these generated data and improve the processing speed, the function is improved by updating the file system version or using new file systems, such as an Extended File System (XFS), B-tree file system (Btrfs), or Flash-Friendly File System (F2FS). However, in the process of updating the existing file system, the metadata structure may be changed or the analysis of the newly released file system may be insufficient, making it impossible for existing commercial tools to extract and restore deleted files. In an actual forensic investigation, when deleted files become unrecoverable, important clues may be missed, making it difficult to identify the culprit. Accordingly, a framework for extracting and recovering files based on The Sleuth Kit (TSK) is proposed by deriving the metadata changed in Ext4 file system journal checksum v3 and XFS file system v5. Thereafter, by comparing the accuracy and recovery rate of the proposed framework with existing commercial tools using the experimental dataset, we conclude that sustained research on file systems should be conducted from the perspective of forensics.