Data investigation based on XFS file system metadata

At present, as the amount of digitized information is increasing geometrically, the importance of digitized information as critical clues from the perspective of criminal investigation is also increasing. The importance of digital forensics has also magnified accordingly. As a fundamental technique of digital forensics, recovery of data deleted to conceal information is extremely important and needs to be studied. Although file system types and versions are diversified, sufficient studies have not been performed. The XFS file system was designed to process huge files, and thus it is expected to be applied in server systems. In this paper, we analyze the XFS file system using its structure and metadata information; then, we propose a technique to recover the deleted files through previous analysis results, and verify it through testing.