【作者】 朱宁；

【导师】 吕红兵；

【作者基本信息】 浙江大学 ， 计算机应用， 2012， 硕士

【摘要】 随着智能移动终端的广泛应用,NAND闪存也得到了大规模的发展,嵌入式系统中NAND闪存上的数据恢复技术也日益彰显其重要性。与传统的磁存储器相比,NAND闪存一方面在硬件上具有耐擦写次数低且不支持原地擦写的“异地存储”等特定的物理特性；另一方面在软件上其文件系统往往采用按块擦写、磨损均衡和垃圾回收等特殊机制。这些软硬件上的特殊性使得传统的数据恢复技术在其上很难发挥原有的作用,因此NAND闪存的数据恢复也成为数字取证领域的一个研究热点和难点问题。目前在市场上占有很高份额的Android智能手机的内核存储器就采用NAND闪存加载YAFFS2文件系统的方式来存储并维护数据。本论文主要研究Android智能手机NAND闪存的数据恢复技术。论文主要工作可分为以下两个方面：首先,论文研究了Android智能手机NAND闪存上的文件恢复技术。利用YAFFS2文件系统把与数据组织密切相关的标记信息存储在NAND闪存的备份区域中并对整个存储空间进行特殊的顺序分配与垃圾回收的特性,借助YAFFS2系统元信息对整个芯片进行时间上的倒序遍历来依次恢复文件数据。在Linux平台下进行的模拟实验以及对Android智能手机内核存储镜像的解析实验表明了文件恢复方法的有效性。其次,在NAND闪存文件恢复技术的基础上,提出了一个NAND闪存文件轨迹的重构方法。根据YAFFS2中同一文件的不同对象头对应不同版本的原则,利用倒序遍历整个芯片搜索对象头的方法来重构不同的历史文件版本。Linux平台下的模拟实验表明本文提出的历史文件轨迹的恢复方法是行之有效的。综上所述,基于文件系统元信息的YAFFS2文件及其历史轨迹恢复方法是一条切实可行的途径。更多还原

【Abstract】 With the extensive application of embedded equipment, data recovering from NAND flash gain more and more importance. Compared with magnetic storage medium, the NAND flash has two main differences. Firstly, from the hardware aspect, NAND is much less written-endurable and abides by the principle of "out-of-place write". Secondly, from the software aspect, file systemsdeployed on NAND flash adopt different approaches to implement mechanisms like "block allocation","wear-leveling","garbage collection" etc. These physical and logical specifics make recovering files from NAND flash by traditional method a difficult thing, thus how to recover files from NAND flash becomes a tricky problem. Nowadays, phones with Android operating system have a large market share,to the knowledge of us, the internal memory of an Android smart phone is a NAND flash chip using YAFFS2to store and manage data. The aim of this dissertation is to reconstruct files and their traces from NAND flash images.The main work of this paper can be divided into two parts.Firstly, this paper proposes a method to recover files from Android internal memory image. Since information which indicates the relationship among data is stored in spare area of NAND flash by YAFFS2, and the storage space of NAND are always allocated sequentially, a method to scan the whole image reversely in chronological order and reconstruct files is proposed.The simulated experiment results under Linux operating system and the real android internal memory images show the efficiency of our method.Secondly, on the basic of the method proposed above, this paper does further research to reconstruct file traces from NAND image. There is an important principle in YAFFS2that every object header indicates a file version. According to this, we scan the whole image reversely in chronological order, find all the object headers and reconstruct different versions. Experiments conducted under Linux operating system prove the proposed algorithm is effective. In summary, the paper proves that it is feasible to reconstruct files and traces from NAND flash image based on YAFFS2metadata.更多还原