Forensics for advanced UNIX file systems

Advanced UNIX file systems differ substantially from traditional UNIX file systems with respect to their internal layout and data structures. This paper analyzes these differences and their effects on the methods and results of digital forensic media analysis. In addition, it provides results from a prototype implementation of a forensic toolkit for an advanced UNIX file system, IBM's Journaling File System for Linux, Finally a generalized scheme for categorizing file system meta-data is proposed.