Poster: Data Recovery from Ransomware Attacks via File System Forensics and Flash Translation Layer Data Extraction
Poster: Data Recovery from Ransomware Attacks via File System Forensics and Flash Translation Layer Data Extraction
复制标题
DOI：
10.1145/3548606.3563538
复制
发表时间：
2022-11
期刊：
影响因子：
--
通讯作者：
Niusen Chen;Josh Dafoe;Bo Chen
中科院分区：
文献类型：
--
作者：
Niusen Chen;Josh Dafoe;Bo Chen
勒索软件近年来越来越流行。为了防御以闪存作为外部存储的计算设备中的勒索软件，现有的设计提取了整个原始闪存数据，以将外部存储恢复到良好状态。然而，它们不能允许用户文件的细粒度恢复，因为原始闪存数据不具有“文件”的语义。在这项工作中，我们设计了FFRecovery，一种新的勒索软件防御策略，可以在攻击后支持细粒度数据恢复。我们的关键思想是，为了恢复被勒索软件破坏的文件，我们可以1)通过文件系统取证恢复其文件系统元数据，2)通过从flash翻译层提取原始数据提取其文件数据，3)组装相应的文件系统元数据和文件数据。开发了一个简单的FFRecovery原型，并给出了一些初步结果。
Ransomware is increasingly prevalent in recent years. To defend against ransomware in computing devices using flash memory as external storage, existing designs extract the entire raw flash memory data to restore the external storage to a good state. However, they cannot allow a fine-grained recovery in terms of user files as raw flash memory data do not have the semantics of "files''. In this work, we design FFRecovery, a new ransomware defense strategy that can support fine-grained data recovery after the attacks. Our key idea is, to recover a file corrupted by the ransomware, we can 1) restore its file system metadata via file system forensics, and 2) extract its file data via raw data extraction from the flash translation layer, and 3) assemble the corresponding file system metadata and the file data. A simple prototype of FFRecovery has been developed and some preliminary results are provided.