Acknowledgement
This work was supported by the National Research Foundation of Korea(NRF) grant funded by the Korea government(MSIT) (NRF-2019R1F1A1058902)
References
- Data Cluster, Wikipedia, https://en.wikipedia.org/wiki/Data_cluster.
- DiskView v2.41, Microsoft Docs, https://docs.microsoft.com/en-us/sysinternals/downloads/ diskview.
- Christopher J. Hargreaves, "Visualisation of allocated and unallocated data blocks in digital forensics," 8th International Annual Workshop on Digital Forensics & Incident Analysis (WDFIA 2013), pp. 133-143. Lisbon, Portugal, May 2013.
- Martin Karresand, Stefan Axelsson, and Geir Olav Dyrkolbotn, "Using NTFS Cluster Allocation Behavior to Find the Location of User Data)," Digital Investigation, Vol. 29, Supplement, pp. S51-S60, July 2019. DOI:https://doi.org/10.1016/j.diin.2019.04.018
- Aaron Burghardt and Adam J. Feldman, "Using the HFS+ journal for deleted file recovery," Digital Investigation, Vol. 5, pp. S76-S82, 2008. DOI:10.1016/j.diin.2008.05.013
- S. G. Bang, S. J. Jeon, D. H. Kim and S. J. Lee "A Study to Improve Ration of Deleted File Using the Parsing Algorithm of the HFS+ Journal File, "KIPS Transaction on Computer and Communication Systems," Vol.5, No.12 pp.463-470, 2016. DOI:https://doi.org/10.3745/KTCCS.2016.5.12.463
- Gyu-Sang Cho, "An Arbitrary Disk Cluster Manipulating Method for Allocating Disk Fragmentation of Filesystem," Journal of KSDIM, Vol. 16, No. 2, pp.11-25, 2020. DOI:http://dx.doi.org/10.17662/ksdim.2020.16.2.011
- HFS Plus, Wikipedia, https://en.wikipedia.org/wiki/HFS_Plus.
- Technical Note TN1150, HFS Plus Volume Format, https://developer.apple.com/legacy/library/technotes/tn/tn1150.html.
- Cory Altheide and Harlan Carvey, Digital Forensics with Open Source Tools, pp. 123-141, 2011
- Amit Singh, Mac OS X Internals: A Systems Approach, Addison-Wesley Professional, 2006.
- The Eclectic Light Companny, Inside the file system: 2 HFS+ volumes, https://eclecticlight.co/2020/10/07/insidethe-file-system-2-hfs-volumes/