A method of recovering deleted data in APFS based on copy-on-write

Abstract

The invention discloses a method for recovering deleted data in an APFS based on copy-on-write. The method is characterized by comprising the following steps: S100, loading disk data; s200, detectingthe disk data and judging whether the disk data is data in an APFS file system format or not, if yes, executing the step S300, and if not, executing the step S100; s300, obtaining each check point super block CSB of the APFS container; s400, analyzing the APFS container check point super block CSB data; s500, analyzing the VCSB data of the volume check point super block; s600, analyzing the volumeB-tree structure; s700, determining deleted data; s800, judging whether the storage space of the deleted data is distributed or not, if yes, executing the step S900, and if not, executing the step SA00; s900, judging whether the allocated block of the deleted data is covered or not, if yes, executing the step S700, and if not, executing the step SB00; sA00, extracting the deleted data in the unallocated blocks, and ending the process; and SB00, extracting uncovered data in the distributed blocks, and ending the process.

Description

technical field [0001] The invention belongs to the field of electronic data restoration and evidence collection, and relates to a method for restoring deleted data in APFS based on copy-on-write. Background technique [0002] APFS is the abbreviation of Apple File System. Apple officially released a new file format at WWDC on June 14, 2016 to replace the currently used HFS+ file system. It is characterized by "optimized flash memory / SSD storage, And with encryption as the main function", the "unique copy-on-write (COW) design" is used on the I / O joint to optimize performance on the basis of ensuring reliability. The core of the system is encryption, which will provide a unified encryption method for each of Apple's devices. The system includes multi-key encryption, with built-in keys for each file, and separate keys for sensitive metadata. [0003] Copy-on-Write COW (Copy-on-Write), as the name implies, is copy-on-write. It is an optimization strategy in the field of com...

AI Technical Summary

Problems solved by technology

[0005] Due to the unique file format and high encryption function of APFS, it is difficult to recover and extract deleted files in APFS

However, in the prior art, there is no method for recovering deleted data in APFS based on copy-on-write, which has caused great difficulties in electronic data recovery and forensics of APFS.

Therefore, there is an urgent need for a method to restore deleted data in APFS based on copy-on-write to make up for the shortcomings of APFS's electronic data recovery and forensics difficulties

Images