UBIFS Deleted Data Recovery via Node Structural Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods lack the capability to recover deleted data from unallocated areas in UBIFS-formatted low flash memory, which is essential for digital forensic analysis.
Innovation Solution
A method and apparatus that collect memory data from low flash memory, configure a UBI volume, and perform structural analysis to identify and recover deleted data by determining node types, such as directory or data nodes, using a B+ tree structure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If methods of acquiring normal data stored in UBIFS are used, then normal data can be retrieved, but deleted data in unallocated areas cannot be recovered
Solution Approach 1:
The patent segments the UBIFS volume into distinct node types (data nodes, directory nodes, index nodes) and processes each type separately through structural analysis. This segmentation enables targeted recovery of deleted data from unallocated areas by examining specific node structures rather than attempting to parse the entire file system, thereby reducing overall complexity while improving recovery capability
Solution Approach 2:
Instead of following the normal file system access path that only retrieves active data, the patent inverts the approach by directly analyzing raw UBIFS structures in unallocated areas. By examining node headers and structural elements directly rather than through file system interfaces, the method recovers deleted data that would otherwise be inaccessible through conventional means
2Loss of information
If structural analysis is performed on all node types in UBIFS volume, then deleted data can be recovered, but analysis time and processing complexity increase
Solution Approach 1:
The patent applies partial action by focusing structural analysis only on leaf nodes (data nodes and directory nodes) that are most likely to contain deleted file content, rather than analyzing all node types in the UBIFS volume. This selective approach recovers deleted data effectively while significantly reducing analysis time compared to a comprehensive analysis of every node structure
Solution Approach 2:
The method applies local quality by tailoring the analysis approach to specific node types - examining data nodes for file content, directory nodes for folder structures, and using their respective structural characteristics. This localized analysis strategy improves recovery efficiency by applying appropriate parsing methods to each node type rather than using a uniform approach across all nodes
Data Source
AI summary
A method of recovering deleted data on a low flash memory formatted in UBIFS according to an embodiment of the present invention includes: (a) a first step of receiving a UBI volume configured by collecting memory data from the low flash memory; and (b) a second step of determining a node type by searching for a node header in all areas of the input UBI volume, and recovering deleted data through a structural analysis performed on each determined node type, wherein the determined node type is either a directory node or a data node, which are leaf nodes according to a B+ tree structure.