An analysis of Ext4 for digital forensics

This paper presents a low-level study and analysis of Ext4 file system data structures. It includes descriptions of extents, extent trees, directory indexing HTrees, and flex block groups. Currently, data about the file system is scattered with most sources focusing on one particular feature. This paper provides a more comprehensive analysis with the forensics community in mind and states some brief implications of the file system behavior with respect to data recovery. (c) 2012 The John Hopkins University, Applied Physics Laboratory. Published by Elsevier Ltd. All rights reserved.