A Digital Forensic Process for Ext4 File System in the Flash Memory of IoT Devices

Junho Jeong, Beomseok Kim, Jinsung Cho

http://doi.org/10.5626/JOK.2021.48.8.865

With the recent rapid advances in digital communication technology, the spread of IoT(Internet of Things) has accelerated and IoT devices can be utilized to investigate crimes and accidents due to the close connection between human society and IoT devices. Accordingly, with the increasing importance of digital forensics, numerous studies have been conducted. However, most digital forensics research proposed only abstract methodologies due to the various types of IoT devices. In addition, binwalk, which is actively used as a firmware analysis tool, does not adequately analyze and extract the ext4 file system. To solve these problems, this paper proposes a proper extraction and analysis method and a practical process that could extract the ext4 file system from the flash memory of IoT devices using the binwalk with the proposed method. This study also verifies the proposed process with DJI Phantom 4 Pro V2.0 drone.