File recovering from YAFFS2 Based on Object Headers and Metadata

摘要

With the popularity of the mobile devices, flash memories have drawn much attention of investigators. In this paper, a method to recover deleted files from YAFFS2 file system was proposed. The YAFFS2 tags stored in spare area of flash and the object header of each files provide a lot of opportunities for investigators, thus were used to find and reassemble all the original files. The simulated experiment results under Linux operating system showed that the proposed method could recover the deleted files as long as they are still on the flash.