Home White Papers What Is New in EXT4 from an Incident Analysis Perspective

What Is New in EXT4 from an Incident Analysis Perspective


ERNW has published an interesting white paper on the analysis of EXT4 file system in the context of an incident analysis, here is the abstract:

“In incident analysis, especially in the field of postmortem file system analysis, the reconstruction of lost or deleted files plays an important role. The techniques that can be applied to this end strongly depend on the specifics of the file system in question. Various file systems are already well-investigated, such as FAT16/32, NTFS for Microsoft Windows systems, and Ext2/3 as the most common file system for Linux systems. There also exist tools, such as the famous Sleuthkit (Carrier, The sleuth kit (TSK), 2010), that provide file recovery features for those file systems by interpreting the file system internal data structures. In case of an Ext file system, the interpretation of the so-called superblock is essential to interpret the data. The Ext4 file system can mainly be analyzed with the tools and techniques that have been developed for its predecessor Ext3, because most principles and internal structures remained unchanged. However, some innovations have been implemented that have to be considered in incident analysis when it comes to manual analysis, or choosing appropriate tools and the interpretation of results. In this article, we report on changes in Ext4 compared to Ext3 that are relevant for incident analysis and illustrate why in cases where the superblock has been corrupted or overwritten, e.g. because of a reformatting of the volume, traditional approaches and tools might fail and for those cases refer to an open source tool that we published earlier this year.”

You can find this white paper here.

Load More Related Articles
Load More In White Papers


  1. 1whipping

    December 30, 2021 at 9:40 pm


  2. gay chat rpulete

    January 2, 2022 at 11:54 am

  3. dating gay latin men

    January 2, 2022 at 5:32 pm

  4. 1amatory

    January 13, 2022 at 12:12 am


  5. 1children

    January 13, 2022 at 12:30 am


  6. growls gay dating

    January 14, 2022 at 3:02 pm

    gay gamer dating sites https://gaypridee.com/

  7. gay roleplay chat

    January 14, 2022 at 7:04 pm

    gay daddy cam chat https://gaytgpost.com/

  8. free gay sex chat apps

    January 14, 2022 at 8:34 pm

    gay chat cam random https://gay-buddies.com/

  9. gay online dating

    January 15, 2022 at 12:08 pm

    which dating app has most gay guys https://speedgaydate.com/