{"id":249,"date":"2016-02-09T19:56:34","date_gmt":"2016-02-09T19:56:34","guid":{"rendered":"https:\/\/www.digitalforensicscorp.com\/blog\/?p=249"},"modified":"2024-12-11T19:28:11","modified_gmt":"2024-12-11T19:28:11","slug":"forensic-analysis-of-flash-friendly-file-system-f2fs","status":"publish","type":"post","link":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/","title":{"rendered":"Flash\u2011Friendly File System (F2FS) Forensics Analysis Guide"},"content":{"rendered":"<p>If you are performing <a href=\"https:\/\/www.digitalforensics.com\/digital-forensics\/cell-phone-forensics\">mobile forensics examinations<\/a> of Android devices, you already know that multiple file systems can exist on a single smartphone or tablet\u2014making data analysis more complex and critical during investigations.<\/p>\n<h2 style=\"text-align: center;\"><span class=\"ez-toc-section\" id=\"Android_file_systems_classification\"><\/span><strong>Android file systems classification<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>These file systems can be classified as flash memory file systems and media based file systems.<\/p>\n<p>Here is flash memory file systems list:<\/p>\n<p><em>YAFFS2<\/em> or Yet Another Flash File System 2 \u2013 the default AOSP (Android Open Source Project) file system for kernel version 2.6.32., which is not supported in its newer versions.<\/p>\n<p><em>JFFS2<\/em> or Journal Flash File System 2 \u2013 the default file system for AOSP kernels since Android 4.0.<\/p>\n<p><em>F2FS<\/em> or Flash-Friendly File System \u2013 an open source flash file system developed by Samsung.<\/p>\n<p><em>exFAT<\/em> or extended File Allocation Table \u2013 a proprietary Microsoft file system.<\/p>\n<p>And here is media based file systems list:<\/p>\n<p><em>EXT 4<\/em> or Extended File System 4 \u2013 a standard Linux file system which is used very often in modern Android mobile devices.<\/p>\n<p><em>FAT<\/em> or File Allocation Table \u2013 a file system introduced by Microsoft in 1977, it has three main variants: FAT 12, FAT 16 and FAT 32.<\/p>\n<p>&nbsp;<\/p>\n<p>In this article we are going to talk about forensic analysis of Motorola Moto G smartphone the \u201cuserdata\u201d partition of which is formatted with F2FS file system.<\/p>\n<h2 style=\"text-align: center;\"><span class=\"ez-toc-section\" id=\"F2FS_brief_overview\"><\/span><strong>F2FS brief overview<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>F2FS is based on the log-structured file system (LFS) design, it means that:<\/p>\n<ul>\n<li>data is always written to previously unused space;<\/li>\n<li>free space is managed in large regions which are written to sequentially.<\/li>\n<\/ul>\n<p>To describe F2FS design and some forensically interesting information we will use file system abstraction model introduced in Brian Carrier\u2019s File System Forensic Analysis (2005).<\/p>\n<h3 style=\"text-align: center;\"><span class=\"ez-toc-section\" id=\"File_system_layer\"><\/span><em>File system layer.<\/em><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><em>\u00a0<\/em>F2FS has six components that make up its file system layer: Superblock, Checkpoint, Segment Information Table (SIT), Node Address Table (NAT), Segment Summary Area (SSA) and Main area.<\/p>\n<p>The partition begins from Superblock. There are two copies of it to avoid file system crash. It includes basic partition information and some default parameters.<\/p>\n<p>Checkpoint contains file system information, bitmaps for valid NAT\/SIT sets, orphan inode lists, and summary entries of current active segments.<\/p>\n<p>SIT includes segment information such as valid block count and bitmap for the validity of all the blocks stored in Main area.<\/p>\n<p>NAT contains block address table for all the node blocks.<\/p>\n<p>SSA includes summary entries which contain the owner information of all the data and node blocks.<\/p>\n<p>Main area contains file and directory data.<\/p>\n<h3 style=\"text-align: center;\"><span class=\"ez-toc-section\" id=\"File_Name_Layer\"><\/span><em>File Name Layer<\/em><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>File names in F2FS are stored in dentry blocks. Each dentry block is 4 K in size and consists of 214 dentries and file names.<\/p>\n<p>A dentry occupies 11 bytes and has four attributes:<\/p>\n<ul>\n<li>hash \u2013 file name\u2019s hash value;<\/li>\n<li>ino \u2013 inode number;<\/li>\n<li>len \u2013 file name length;<\/li>\n<li>type \u2013 file type (directory, symlink, etc).<\/li>\n<\/ul>\n<p>A dentry block has the following structure: bitmap (27 bytes) \u2013 reserved (3 bytes) \u2013 214 dentries (11 bytes each) \u2013 214 file names (8 bytes each). Dentry blocks form buckets.<\/p>\n<p>&nbsp;<\/p>\n<h3 style=\"text-align: center;\"><span class=\"ez-toc-section\" id=\"Metadata_layer\"><\/span><em>Metadata layer<\/em><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>&nbsp;<\/p>\n<p>F2FS, like traditional file systems, has three types of node: inode, direct node, indirect node. An inode contains lots of forensically important information, such as file size, allocated blocks, ownership (including UID and GID) and MAC times (Modified, Accessed, Changed).<\/p>\n<p>The Modified timestamp is updated when the file or directory is written.<\/p>\n<p>The Accessed timestamp is updated when the file or directory is read.<\/p>\n<p>The Changed timestamp is updated when the inode is modified.<\/p>\n<p>&nbsp;<\/p>\n<h3 style=\"text-align: center;\"><span class=\"ez-toc-section\" id=\"Data_Unit_Layer\"><\/span><em>Data Unit Layer<\/em><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>&nbsp;<\/p>\n<p>Like many other file systems, F2FS is comprised of blocks. Each block is 4K in size.<\/p>\n<p>Blocks are collected into segments. Each segment contains 512 blocks and is 2MB in size. Each segment has segment summary block (file plus offset of each block in the segment).<\/p>\n<p>Segments are collected into sections. Sections have flexible size (power of two). There are always six sections \u201copen\u201d for writing at any time. This allows the data to be kept separate from indexing information (nodes).<\/p>\n<p>Sections are collected into zones. These zones make up the main area of the filesystem.<\/p>\n<p>&nbsp;<\/p>\n<h2 style=\"text-align: center;\"><span class=\"ez-toc-section\" id=\"The_case\"><\/span><strong>The case<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>&nbsp;<\/p>\n<p>Recently we received a Motorola Moto G smartphone for a digital forensic examination. The smartphone was damaged, so we decided to use the chip-off data extraction technique.<\/p>\n<p>The circuit board was removed from the phone (fig. 1).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-250 aligncenter\" src=\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/02\/11.png\" alt=\"11\" width=\"800\" height=\"500\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/11.png 800w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/11-300x188.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/11-768x480.png 768w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/11-512x320.png 512w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Figure 1. Phone\u2019s circuit board<\/em><\/p>\n<p>&nbsp;<\/p>\n<p>There is a MICRON eMCP chip on the board (fig. 2).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-251 aligncenter\" src=\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/02\/22.png\" alt=\"22\" width=\"600\" height=\"300\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/22.png 600w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/22-300x150.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/22-512x256.png 512w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Figure 2. MICRON eMCP chip<\/em><\/p>\n<p><em>\u00a0<\/em><\/p>\n<p>The chip contains both DDR3 and eMMC memory. The most difficult part was to find proper pinout configuration, because where was no datasheet in public access.<\/p>\n<p>Finally, we had found the pinout and the chip was removed from the board. Than EMMC ROM1 (Main User Data) was imaged.<\/p>\n<p>We tried to use PC 3000 Data Extractor and Oxygen Forensic Analyst to analyze the image, but no tool could read the \u201cuserdata\u201d partition. The thing is \u2013 the partition was formatted with F2FS.<\/p>\n<p>For further analysis we used Santoku Linux. At first, we copied our image (emmc.img) to the Desktop. We started from \u201cmmls\u201d command (from the Sleuth kit) and got the following output:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-252 aligncenter\" src=\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-09-at-20.19.28.png\" alt=\"Screen Shot 2016-02-09 at 20.19.28\" width=\"479\" height=\"861\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-09-at-20.19.28.png 479w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-09-at-20.19.28-167x300.png 167w\" sizes=\"auto, (max-width: 479px) 100vw, 479px\" \/><\/p>\n<p>As you could see, the \u201cuserdata\u201d partition was 10485504 in length. To mount the partition we used \u201ckpartx\u201d. To create device-mappings for each partition in the image we used the following command:<\/p>\n<p><em>sudo kpartx -v -a \/home\/santoku\/Desktop\/emmc.img<\/em><\/p>\n<p>And got the following output:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-253 aligncenter\" src=\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-09-at-20.25.57.png\" alt=\"Screen Shot 2016-02-09 at 20.25.57\" width=\"452\" height=\"576\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-09-at-20.25.57.png 452w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-09-at-20.25.57-235x300.png 235w\" sizes=\"auto, (max-width: 452px) 100vw, 452px\" \/><\/p>\n<p>So, the \u201cuserdata\u201d partition was mapped to \/dev\/mapper\/loop0p44. How did we guess? Look at the length!<\/p>\n<p>Santoku had \u201cf2fs_tools\u201d installed, so we could mount the partition. The following command was used:<\/p>\n<p><em>sudo mount -t f2fs \/dev\/mapper\/loop0p44 \/media\/userdata -o ro<\/em><\/p>\n<p>The \u201cuserdata\u201d partition was successfully mounted at \/media\/userdata and all the files could be copied out of it and analyzed (fig. 3).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-254 aligncenter\" src=\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-08-at-21.06.23.png\" alt=\"Screen Shot 2016-02-08 at 21.06.23\" width=\"656\" height=\"464\" srcset=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-08-at-21.06.23.png 656w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-08-at-21.06.23-300x212.png 300w, https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/Screen-Shot-2016-02-08-at-21.06.23-512x362.png 512w\" sizes=\"auto, (max-width: 656px) 100vw, 656px\" \/><\/p>\n<p style=\"text-align: center;\"><em>Figure 3. The \u201cuserdata\u201d partition contents<\/em><\/p>\n<p>Extacted files were analyzed with UFED Physical Analyzer, Oxygen Forensic Analyst, Internet Evidence Finder and Belkasoft Evidence Center \u2013 we got similar results.<\/p>\n<p>In this particular case we needed to recover deleted images. To do it we used classic carving technique. The tool we used was \u201cscalpel\u201d. Using it we successfully recovered lots of images, both taken with the mobile device\u2019s camera and downloaded by the user.<\/p>\n<p>As you can see, forensic analysis of F2FS is not an impossible task, even if you are armed with only open source digital forensic tools.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"About_the_authors\"><\/span>About the authors:<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><a href=\"http:\/\/linkedin.com\/in\/igormikhaylovcf\" target=\"_blank\" rel=\"noopener\">Igor Mikhaylov<\/a><\/p>\n<p>Interests: Computer, Cell Phone &amp; Chip-Off Forensics<\/p>\n<p><a href=\"https:\/\/www.linkedin.com\/in\/oleg-skulkin-96652a87\" target=\"_blank\" rel=\"noopener\">Oleg Skulkin<\/a><\/p>\n<p>Interests: iOS forensics, Android forensics, Mac OS X forensics, Windows forensics, Linux forensics<\/p>\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"If you are performing mobile forensics examinations of Android devices, you already know that multiple file systems can&hellip;","protected":false},"author":126,"featured_media":255,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","footnotes":""},"categories":[6],"tags":[],"class_list":{"0":"post-249","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-software","8":"cs-entry"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Forensic analysis of Flash-Friendly File System (F2FS)<\/title>\n<meta name=\"description\" content=\"Learn how to perform forensic analysis of the F2FS file system on Android devices. Explore file system layers, metadata structures, segments, zones, and key artifacts.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Flash\u2011Friendly File System (F2FS) Forensics Analysis Guide\" \/>\n<meta property=\"og:description\" content=\"Learn how to perform forensic analysis of the F2FS file system on Android devices. Explore file system layers, metadata structures, segments, zones, and key artifacts.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/\" \/>\n<meta property=\"og:site_name\" content=\"Resources for Sextortion and Online Blackmail Victims\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/DigitalForensicsCorp\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-02-09T19:56:34+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-12-11T19:28:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/weare4n6_articles.png\" \/>\n\t<meta property=\"og:image:width\" content=\"600\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Viktor Sobiecki\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ForensicsCorp\" \/>\n<meta name=\"twitter:site\" content=\"@ForensicsCorp\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Viktor Sobiecki\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/\"},\"author\":{\"name\":\"Viktor Sobiecki\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/db7b63895c111dc8ed48df38d20b84ce\"},\"headline\":\"Flash\u2011Friendly File System (F2FS) Forensics Analysis Guide\",\"datePublished\":\"2016-02-09T19:56:34+00:00\",\"dateModified\":\"2024-12-11T19:28:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/\"},\"wordCount\":1083,\"publisher\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/02\\\/weare4n6_articles.png\",\"articleSection\":[\"Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/\",\"name\":\"Forensic analysis of Flash-Friendly File System (F2FS)\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/02\\\/weare4n6_articles.png\",\"datePublished\":\"2016-02-09T19:56:34+00:00\",\"dateModified\":\"2024-12-11T19:28:11+00:00\",\"description\":\"Learn how to perform forensic analysis of the F2FS file system on Android devices. Explore file system layers, metadata structures, segments, zones, and key artifacts.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/02\\\/weare4n6_articles.png\",\"contentUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/02\\\/weare4n6_articles.png\",\"width\":600,\"height\":400},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/forensic-analysis-of-flash-friendly-file-system-f2fs\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims\",\"item\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/software\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Flash\u2011Friendly File System (F2FS) Forensics Analysis Guide\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/\",\"name\":\"Resources for Sextortion and Online Blackmail Victims\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#organization\",\"name\":\"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/df-logo.png\",\"contentUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/df-logo.png\",\"width\":393,\"height\":343,\"caption\":\"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims\"},\"image\":{\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/DigitalForensicsCorp\\\/\",\"https:\\\/\\\/x.com\\\/ForensicsCorp\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/#\\\/schema\\\/person\\\/db7b63895c111dc8ed48df38d20b84ce\",\"name\":\"Viktor Sobiecki\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/viktor-sobiecki_avatar-96x96.jpg\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/viktor-sobiecki_avatar-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/viktor-sobiecki_avatar-96x96.jpg\",\"caption\":\"Viktor Sobiecki\"},\"description\":\"Dr. Viktor Sobiecki currently serves as the Chief Technology Officer (CTO) at Digital Forensics Corporation, where responsibilities span the leadership of advanced cybersecurity initiatives, data breach incident responses, and corporate strategic planning. Professional career has been driven by the intersection of innovation and practical application, particularly in the domains of cybersecurity and cyber crime investigations. He holds a Ph.D. in Computer Science and has contributed extensively to academic and industry advancements through publications, patents, and technological solutions addressing complex real-world challenges. As a professional with over 25 years of experience in the fields of cybersecurity, artificial intelligence, and digital forensics his career spans roles in academic research, software development, corporate leadership, and expert consulting, giving me a comprehensive understanding of the technical, strategic, and practical dimensions of projects. Expertise spans a wide range of technical domains, including: \u2022 Data Breach Incident Response: Managing immediate responses to cybersecurity crises, including the containment and mitigation of threats \u2022 Corporate Strategy Development: Designing long-term strategies to enhance organizational resilience against emerging cyber threats. \u2022 Expert Testimony: Providing legal and technical expertise in high-profile cybersecurity cases. \u2022 Artificial Intelligence and Machine Learning: Designing and implementing algorithms for data analysis, pattern recognition, and anomaly detection. \u2022 Network Security and Data Integrity: Developing solutions to protect critical systems from cyber threats, including encryption protocols and intrusion detection systems. \u2022 Cloud Computing and Hybrid Infrastructures: Creating scalable, resilient architectures for data storage, processing, and security.\",\"sameAs\":[\"https:\\\/\\\/www.digitalforensics.com\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/viktor-sobiecki\\\/\"],\"honorificPrefix\":\"Dr\",\"jobTitle\":\"Chief Technology Officer (CTO)\",\"worksFor\":\"Digital Forensics Corporation\",\"url\":\"https:\\\/\\\/www.digitalforensics.com\\\/blog\\\/author\\\/visor\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Forensic analysis of Flash-Friendly File System (F2FS)","description":"Learn how to perform forensic analysis of the F2FS file system on Android devices. Explore file system layers, metadata structures, segments, zones, and key artifacts.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/","og_locale":"en_US","og_type":"article","og_title":"Flash\u2011Friendly File System (F2FS) Forensics Analysis Guide","og_description":"Learn how to perform forensic analysis of the F2FS file system on Android devices. Explore file system layers, metadata structures, segments, zones, and key artifacts.","og_url":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/","og_site_name":"Resources for Sextortion and Online Blackmail Victims","article_publisher":"https:\/\/www.facebook.com\/DigitalForensicsCorp\/","article_published_time":"2016-02-09T19:56:34+00:00","article_modified_time":"2024-12-11T19:28:11+00:00","og_image":[{"width":600,"height":400,"url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/weare4n6_articles.png","type":"image\/png"}],"author":"Viktor Sobiecki","twitter_card":"summary_large_image","twitter_creator":"@ForensicsCorp","twitter_site":"@ForensicsCorp","twitter_misc":{"Written by":"Viktor Sobiecki","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/#article","isPartOf":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/"},"author":{"name":"Viktor Sobiecki","@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/person\/db7b63895c111dc8ed48df38d20b84ce"},"headline":"Flash\u2011Friendly File System (F2FS) Forensics Analysis Guide","datePublished":"2016-02-09T19:56:34+00:00","dateModified":"2024-12-11T19:28:11+00:00","mainEntityOfPage":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/"},"wordCount":1083,"publisher":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/weare4n6_articles.png","articleSection":["Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/","url":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/","name":"Forensic analysis of Flash-Friendly File System (F2FS)","isPartOf":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/#primaryimage"},"image":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/weare4n6_articles.png","datePublished":"2016-02-09T19:56:34+00:00","dateModified":"2024-12-11T19:28:11+00:00","description":"Learn how to perform forensic analysis of the F2FS file system on Android devices. Explore file system layers, metadata structures, segments, zones, and key artifacts.","breadcrumb":{"@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/#primaryimage","url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/weare4n6_articles.png","contentUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/02\/weare4n6_articles.png","width":600,"height":400},{"@type":"BreadcrumbList","@id":"https:\/\/www.digitalforensics.com\/blog\/software\/forensic-analysis-of-flash-friendly-file-system-f2fs\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.digitalforensics.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Tips, Services, and Key Resources for Cybercrime Victims","item":"https:\/\/www.digitalforensics.com\/blog\/software\/"},{"@type":"ListItem","position":3,"name":"Flash\u2011Friendly File System (F2FS) Forensics Analysis Guide"}]},{"@type":"WebSite","@id":"https:\/\/www.digitalforensics.com\/blog\/#website","url":"https:\/\/www.digitalforensics.com\/blog\/","name":"Resources for Sextortion and Online Blackmail Victims","description":"","publisher":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.digitalforensics.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.digitalforensics.com\/blog\/#organization","name":"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims","url":"https:\/\/www.digitalforensics.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2024\/12\/df-logo.png","contentUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2024\/12\/df-logo.png","width":393,"height":343,"caption":"Digital Defense Hub: Resources for Sextortion and Online Blackmail Victims"},"image":{"@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/DigitalForensicsCorp\/","https:\/\/x.com\/ForensicsCorp"]},{"@type":"Person","@id":"https:\/\/www.digitalforensics.com\/blog\/#\/schema\/person\/db7b63895c111dc8ed48df38d20b84ce","name":"Viktor Sobiecki","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/07\/viktor-sobiecki_avatar-96x96.jpg","url":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/07\/viktor-sobiecki_avatar-96x96.jpg","contentUrl":"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/07\/viktor-sobiecki_avatar-96x96.jpg","caption":"Viktor Sobiecki"},"description":"Dr. Viktor Sobiecki currently serves as the Chief Technology Officer (CTO) at Digital Forensics Corporation, where responsibilities span the leadership of advanced cybersecurity initiatives, data breach incident responses, and corporate strategic planning. Professional career has been driven by the intersection of innovation and practical application, particularly in the domains of cybersecurity and cyber crime investigations. He holds a Ph.D. in Computer Science and has contributed extensively to academic and industry advancements through publications, patents, and technological solutions addressing complex real-world challenges. As a professional with over 25 years of experience in the fields of cybersecurity, artificial intelligence, and digital forensics his career spans roles in academic research, software development, corporate leadership, and expert consulting, giving me a comprehensive understanding of the technical, strategic, and practical dimensions of projects. Expertise spans a wide range of technical domains, including: \u2022 Data Breach Incident Response: Managing immediate responses to cybersecurity crises, including the containment and mitigation of threats \u2022 Corporate Strategy Development: Designing long-term strategies to enhance organizational resilience against emerging cyber threats. \u2022 Expert Testimony: Providing legal and technical expertise in high-profile cybersecurity cases. \u2022 Artificial Intelligence and Machine Learning: Designing and implementing algorithms for data analysis, pattern recognition, and anomaly detection. \u2022 Network Security and Data Integrity: Developing solutions to protect critical systems from cyber threats, including encryption protocols and intrusion detection systems. \u2022 Cloud Computing and Hybrid Infrastructures: Creating scalable, resilient architectures for data storage, processing, and security.","sameAs":["https:\/\/www.digitalforensics.com\/","https:\/\/www.linkedin.com\/in\/viktor-sobiecki\/"],"honorificPrefix":"Dr","jobTitle":"Chief Technology Officer (CTO)","worksFor":"Digital Forensics Corporation","url":"https:\/\/www.digitalforensics.com\/blog\/author\/visor\/"}]}},"_links":{"self":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts\/249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/users\/126"}],"replies":[{"embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/comments?post=249"}],"version-history":[{"count":4,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts\/249\/revisions"}],"predecessor-version":[{"id":16019,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/posts\/249\/revisions\/16019"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/media\/255"}],"wp:attachment":[{"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/media?parent=249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/categories?post=249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.digitalforensics.com\/blog\/wp-json\/wp\/v2\/tags?post=249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}