Reassembling Linux-based Hybrid RAID

Network-attached storage (NAS) is a system that uses a redundant array of disks (RAID) to create virtual disks comprising multiple disks and provide network services such as FTP, SSH, and WebDAV. Using these services, the NAS's virtual disks store data about individuals or groups, making them a critical analysis target for digital forensics. Well-known storage manufacturers like Seagate, Synology, and NETGEAR use Linux-based software RAID, and they usually support Berkeley RAID (e.g., RAID 0, 1, 5, 6, and 10) as well as self-developed hybrid RAID. Those manufacturers have published data on the introduction and features of hybrid RAID, but there is not enough information to reassemble RAID from a digital forensic perspective. Besides, digital forensic tools (such as EnCase, FTK, X-ways, and RAID Reconstructor) do not support automatic RAID reassembly for hybrid RAID, so research on hybrid RAID reassembly methods is necessary. This paper analyzes the disk array composed of hybrid RAID and explains the layout of disk array, partition layout in hybrid RAID, and hybrid RAID configuration strategy. Furthermore, it suggests parameters that are required for RAID reassembly and then propose a hybrid RAID reassembly procedure using them. Finally, we propose a proof-of-concept tool (Hybrid RAID Reconstructor) that identifies hybrid RAID from disk array and parse RAID parameters.     

基于Linux平台计算机基础教学的探讨

Linux作为优秀的操作系统,在桌面应用、网络服务、嵌入式等领域有着极为广泛的应用,那么如何让学生了解并掌握Linux操作系统呢?本文通过介绍Linux系统的特性,分析了基于Linux平台的计算机基础教学的必要性与可行性,并指出进行基于Linux平台的计算机基础教学的内容与教学方法的选择。     

基于Linux的计算机音乐制作系统的应用研究

论文首先指出计算机音乐制作系统的主要应用领域，应是“大”的电子音乐环境。然后通过分析多部当代电子音乐作品的构思、创作、表演阶段的技术实施过程，得出了“以计算机和计算机技术为主体的工作环境，已经成为当代电子音乐的主流实现平台”的结论。     

Forensic analysis of smart TV: A current issue and call to arms

A number of new entertainment systems have appeared on the market that have embedded computing capabilities. Smart Televisions have the ability to connect to networks, browse the web, purchase applications and play games. Early versions were based on proprietary operating systems; newer versions released from 2012 are based on existing operating systems such as Linux and Android. The question arises as to what sort of challenges and opportunities they present to the forensics examiner. Are these new platforms or simply new varieties of existing forms of devices? What data do they retain and how easy is it to access this data? This paper explores this as a future forensic need and asks if we are missing potential sources of forensic data and to what degree we are ready to process these systems as part of an investigation.     

The Linux FAT32 allocator and file creation order reconstruction

The allocation algorithm of the Linux FAT32 file system driver positions files on disk in such a way that their relative positions reveal information on the order in which these files have been created. This provides an opportunity to enrich information from (carved) file fragments with time information, even when such file fragments lack the file system metadata in which time-related information is usually to be found.Through source code analysis and experiments the behaviour of the Linux FAT allocator is examined. How an understanding of this allocator can be applied in practice is demonstrated with a case study involving a TomTom GPS car navigation device. In this case, time information played a crucial role. Large amounts of location records could be carved from this device's flash storage, yielding insight into the locations the device has visited—yet the carved records themselves offered no information on when the device had been at the locations. Still, bounds on the records' time of creation could be inferred when making use of filesystem timestamps related to neighbouring on-disk positions.Finally, we perform experiments which contrast the Linux behaviour with that of Windows 7. We show that the latter differs subtly, breaking the strong relation between creation order and position.     

Robust Linux memory acquisition with minimal target impact

Software based Memory acquisition on modern systems typically requires the insertion of a kernel module into the running kernel. On Linux, kernel modules must be compiled against the exact version of kernel headers and the exact kernel configuration used to build the currently executing kernel. This makes Linux memory acquisition significantly more complex in practice, than on other platforms due to the number of variations of kernel versions and configurations, especially when responding to incidents. The Linux kernel maintains a checksum of kernel version and will generally refuse to load a module which was compiled against a different kernel version. Although there are some techniques to override this check, there is an inherent danger leading to an unstable kernel and possible kernel crashes. This paper presents a novel technique to safely load a pre-compiled kernel module for acquisition on a wide range of Linux kernel versions and configuration. Our technique injects a minimal acquisition module (parasite) into another valid kernel module (host) already found on the target system. The resulting combined module is then relinked in such a way as to grant code execution and control over vital data structures to the acquisition code, whilst the host module remains dormant during runtime.     

Unix系统计算机取证中数据恢复方法探讨

计算机犯罪和网络入侵事件给司法取证提出了新的要求,恢复计算机中被删除的信息成为获取证据和犯罪线索的一种重要手段。文章介绍了Unix系统中文件的存储及删除原理,着重探讨了利用系统命令、Debugfs工具、RAW文件等方式恢复数据取得证据的方法。     

基于Linux平台的VPN设计及实现

本文介绍虚拟专用网的原理和产生需求。笔者对Linux下实现虚拟专用网的技术进行了研究和实践,结合本单位实际,架设了一台VPN服务器,通过虚拟专用网技术实现了不同办公区域用户正常使用内部资源,达到了资源共享的目的。     

嵌入式Web服务器研究与设计

介绍了以Linux为操作系统,基于ARM9的嵌入式Web服务器的设计,从软硬件两方面详细阐述嵌入式Web服务器实现中的一些具体技术及方案,并且对TCP/IP协议族进行一定裁减,实现了基于ARM的WEB服务器.     

Comments on the Linux FAT32 allocator and file creation order reconstruction [Digit Investig 11(4), 224–233]

Minnaard proposed a novel method that constructs a creation time bound of files recovered without time information. The method exploits a relationship between the creation order of files and their locations on a storage device managed with the Linux FAT32 file system. This creation order reconstruction method is valid only in non-wraparound situations, where the file creation time in a former position is earlier than that in a latter position. In this article, we show that if the Linux FAT32 file allocator traverses the storage space more than once, the creation time of a recovered file is possibly earlier than that of a former file and possibly later than that of a latter file on the Linux FAT32 file system. Also it is analytically verified that there are at most n candidates for the creation time bound of each recovered file where n is the number of traversals by the file allocator. Our analysis is evaluated by examining file allocation patterns of two commercial in-car dashboard cameras.