• Journal of Korea Society of Digital Industry and Information Management
• /
• v.16 no.2
• /
• pp.11-25
• /
• 2020

This study proposes a method to manipulate fragmentation of disks by arbitrarily allocating and releasing the status of a disk cluster in the NTFS file system. This method allows experiments to be performed in several studies related to fragmentation problems on disk cluster. Typical applicable research examples include testing the performance of disk defragmentation tools according to the state of fragmentation, establishing an experimental environment for fragmented file carving methods for digital forensics, setting up cluster fragmentation for testing the robustness of data hiding methods within directory indexes, and testing the file system's disk allocation methods according to the various version of Windows. This method suggests how a single file occupies a cluster and presents an algorithm with a flowchart. It raises three tricky problems to solve the method, and we propose solutions to the problems. Experiments for allocating the disk cluster to be fragmented to the maximum extent possible, it then performs a disk defragmentation experiment to prove the proposed method is effective.

• Journal of KIISE
• /
• v.43 no.6
• /
• pp.627-635
• /
• 2016

When many processes issue write operations alternately on Log-structured File System (LFS), the created files can be fragmented on the file system layer although LFS sequentially allocates new blocks of each process. Unfortunately, this file fragmentation degrades read performance because it increases the number of block I/Os. Additionally, read-ahead operations which increase the number of data to request at a time exacerbates the performance degradation. In this paper, we suggest a new cleaning method on LFS that minimizes file fragmentation. During a cleaning process of LFS, our method sorts valid data blocks by inode numbers before copying the valid blocks to a new segment. This sorting re-locates fragmented blocks contiguously. Our cleaning method experimentally eliminates 60% of file fragmentation as compared to file fragmentation before cleaning. Consequently, our cleaning method improves sequential read throughput by 21% when read-ahead is applied.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06c
• /
• pp.245-247
• /
• 2012

We know that JPEG image format is one of the most popular image formats in the digital area and distribution of digital photographic drawing it is interested frequently in certain types of forensic investigation. In most case, corrupted images are shown gaudiness with the boundary of the corrupted parts. In the paper, we propose a technique to carve correct JPEG images using transformation method and the approach can be used for JPEG image file carving tool development.

• The KIPS Transactions:PartA
• /
• v.8A no.4
• /
• pp.331-338
• /
• 2001

With the general use of network, cyber terror rages throughout the world. However, IP Fragmentation isn\`t free from its security problem yet, even though it guarantees effective transmission of the IP package in its network environment. Illegal invasion could happen or disturb operation of the system by using attack mechanism such as IP Spoofing, Ping of Death, or ICMP taking advantage of defectiveness, if any, which IP Fragmentation needs improving. Recently, apart from service refusal attack using IP Fragmentation, there arises a problem that it is possible to detour packet filtering equipment or network-based attack detection system using IP Fragmentation. In the paper, we generate the real time access log file to make the system manager help decision support and to make the system manage itself in case that some routers or network-based attack detection systems without packet reassembling function could not detect or suspend illegal invasion with divided datagrams of the packet. Through the implementation of the self-managing system we verify its validity and show its future effect.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.4
• /
• pp.835-845
• /
• 2019

File Carving is a technique for attempting to recover a file without metadata, such as a formated storage media or a damaged file system, and generally looks for a specific header / footer signature and data structure of the file. However, file carving is faced with the problem of recovering fragmented files for a long time, and it is very important to propose a solution for digital forensics because important files are relatively fragmented. To overcome these limitations, various carving techniques and tools are continuously being developed, and data sets from various researches and institutions are provided for functional verification. However, existing data sets are ineffective in verifying tools because of their limited environmental conditions. Therefore, this paper refers to the importance of fragmented file carving and develops 16 images for carving tool verification based on scenarios. The developed images' carving rate and accuracy of each media is shown through Foremost which is well known as a commercial carving tool.

• Journal of Internet Computing and Services
• /
• v.21 no.3
• /
• pp.93-102
• /
• 2020

In order for data obtained through all stages of digital crime investigation to be recognized as evidence capability, it must satisfy legal / technical requirements. In this paper, we propose a mechanism and implement software to provide digital forensic evidence by automatically recovering files by scanning / inspecting the unallocated area inside the storage disk block without relying on information provided by the file system. The proposed technique checks / analyzes the RAW disk data of the system under analysis in 512-byte block units based on information on the storage format / file structure of various files stored on the disk without referring to the file system-related information provided by the operating system. The file carving process was implemented, and a smart carving mechanism was proposed to intelligently restore deleted or damaged files in the storage device. As a result, we have provided a block based smart carving method to intelligently identify fragmented and damaged files in storage efficiently for forgery analysis on digital forensic investigation.

• Journal of KIISE:Computer Systems and Theory
• /
• v.31 no.5_6
• /
• pp.268-278
• /
• 2004

In this paper, we describe our experience in the design and implementation of the SMART file system to handle multimedia workload. Our work has three design objectives: (ⅰ) efficient support for sequential workload, (ⅱ) avoiding disk fragmentation, (ⅲ) logical unit based file access. To achieve these three objectives, we develop a file system where a file consists of linked list of Data Unit Group. Instead of tree like structure of the legacy Unix file system, we use single level file structure. Our file system can also access the file based upon the logical unit which can be video frame or audio samples. Data Unit Group is a group of logical data units which is allocated continuous disk blocks. At the beginning of each Data Unit Group, there exists an index array. Each index points to the beginning of logical data units, e.g. frames in the Data Unit Group. This index array enables the random access and sequencial access of semantic data units. SMART file system is elaborately tailored to effectively support multimedia workload. We perform physical experiments and compare the performance of SMART file system with EXT2 file system and SGI XFS file system. In this experiment, SMART file system exhibits superior performance under streaming workload.

• The KIPS Transactions:PartA
• /
• v.16A no.2
• /
• pp.101-112
• /
• 2009

Existing techniques for defragmentation of the file system need intensive disk operation for some periods at specific time such as disk defragmentation program. In this paper, for solving this problem, we design and implement the automatic and continuous defragmentation free system by distributing the disk operation. We propose the Automatic Layout Scoring(ALS) mechanism for measuring defragmentation degree and suggest the Lazy Copy mechanism that copies the defragmented data at idle time for scattering the disk operation. We search the defragmented file by Automatic Layout Scoring mechanism and then find for empty spaces for that searched file. After lazy copy of searched fils to empty space for preventing that file from being lost, the algorithm solves the defragmentation problem by updating the I-node of that file. We implement these algorithms in Linux and evaluate them for small and defragmented file to get the layout scoring. We outperform the Linux EXT2 file system by $2.4%{\sim}10.4%$ in layout scoring evaluation. And the performance of read and write for various file size is better than the EXT2 by $1%{\sim}8.5%$ for write performance and by $1.2%{\sim}7.5%$ for read performance. We suggest this system for solving the problem of defragmentation automatically without disturbing the I/O task and manual management.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.6
• /
• pp.145-152
• /
• 2012

Due to the large sizes of streaming media, previous delivery techniques are not providing optimal performance. For this purpose, video proxy server is employed for reducing the bandwidth consumption, network congestion, and network traffic. This paper proposes a fast distributed network file system using state transition model in the media streaming system for efficient utilization of video proxy server. The proposed method is composed of three steps: step 1. Training process using state transition model, step 2. base and decision probability generation, and step 3. storing and deletion based on probability. In addition, storage space of video proxy server is divided into each segment area in order to store the segments efficiently and to avoid the fragmentation. The simulation results show that the proposed method performs better than other methods in terms of hit rate and number of deletion. Therefore, the proposed method provides the lowest user start-up latency and the highest bandwidth saving significantly.

• Proceedings of the Korean Information Science Society Conference
• /
• 2007.06b
• /
• pp.377-380
• /
• 2007

플래시 메모리는 무게, 내구성, 전력 소비량 측면에서 기존 디스크보다 우수하기 때문에 주로 휴대용 기기의 저장장치로 사용되었다. 최근에는 집적도가 향상되면서 SSD(Solid State Disk)형태로 노트북에서도 활용되고 있다. 이러한 플래시 메모리는 제자리 갱신이 불가능한 특징 때문에 저장장치로 사용하기 위해서는 FTL(Flash Memory Translation Layer)이라는 주소사상 소프트웨어가 필요하다. 그리고 FTL은 블록을 재활용하기 위해 병합 연산을 수행하게 되는데 이 병합 연산의 비용이 시스템 성능에 큰 영향을 미친다. 아울러 FTL 상에서 동작하는 파일 시스템의 경우도 디스크 기반 파일 시스템과 같이 단편화 문제로 인한 성능 저하가 발생하게 된다. 본 논문에서는 플래시 메모리 기반 파일 시스템에서 단편화 현상을 줄이기 위해 FTL의 병합동작의 특성을 활용한 조각 모음 기법을 제안한다. 실험결과는 제안한 기법이 결국 FTL에서 병합 연산의 비용을 줄임으로써 성능을 향상시킬 수 있음을 보여준다.