Looking for:
Looking for:
Unyaffs2 windows download
Latest commit. Git stats 1 commit. Failed to load latest commit information. View code. Currently, it inclueds the following tools: 1 mkyaffs2: making a yaffs2 yaffs1 image 2 unyaffs2: extract a yaffs2 yaffs1 image made by mkyaffs2. This project is developed under the Debian Linux 5 code Lenny. It can make a yaffs2 image to be ran under my embedded system Linux 2. Due to some lack of the official utilities from yaffs2. A tool named “unyaffs2” is also provided to extract the image made from its “mkyaffs2”.
The license for this package is stated as GPLv2 only. I will be glad if someone can help me to verify the integrity to make and extract a yaffs1 image. If the oob layout is differed from the Linux default, the tool “unspare2” can be used to extract the oob layout from the NAND device. If the endian is different from your building system, The option “-e” is required while executing the “unspare2” on the targets.
As the discussion in the previous section “yaffs2utils”, an image created by the official YAFFS2 tools mkyaffs2image can not be run on the native Linux, because its oob layout is different from the default one in the Linux MTD subsystem. TODO 1. Option -t lists all the file names in the image without extracting them.
When combined with -t it generates an extended file listing, nothing is extracted. If the extraction directory is not given, the files are stored into the current directory. The permissions and modification dates are restored. When run as root, the ownership is restored as well. Please be careful extracting images as root. It might be possible, that important system files get overwritten. Header chunks and data chunks. YAFFS2 distinguishes between header chunks used to store an object s name and meta data and data chunks which are used to store an object s actual data content [Man10].
The meta data in such aheader chunk describes if the corresponding object is adirectory, regular data file, hard link or soft link.
In Table 1the structure of aregular file with three chunks of data and one header chunk is shown. If a file shrinks in size, data chunks become invalid and the corresponding header chunk receives a special shrink-header marker to indicate this. In Table 2 we show how a deleted file looks like. In this case chunk number 5indicates that the file had been deleted and this chunk receives the shrink-header marker.
As we show below, shrink-header markers are important because object headers with this marker are prevented from being deleted by garbage collection [Man10, Sect. Each object file, link, folder, etc. AChunk ID of 0 indicates that this chunk holds an object header.
Adifferent value indicates that this is a data chunk. The value of the Chunk ID stands for the position of the chunk in the file. The tnode tree. This tree is used to provide mapping of object positions to actual chunk positions on anand flash memory device.
This tree s nodes are called tnodes [Man10, Sect ]. Checkpoint data. Checkpoint data is written from RAM to ayaffs2 NAND device on unmounting and contains information about all of adevice s blocks and objects a subset of information stored in the tnode tree. It is used to speed up mounting of ayaffs2 NAND device. The number of blocks needed to store acheckpoint consists of 1 a fixed number of bytes used for checksums and general information regarding the device and 2 avariable number of bytes depending on the number of objects stored on the device and the device s size.
The variable part of a checkpoint consists of information on blocks, objects and tnodes. Among all of YAFFS2 s characteristics and functionalities, the garbage collection algorithm has the most significant impact on the amount of deleted or modified data that can be recovered from a NAND. In this section, we describe the different garbage collection methods Section 3. An important variant of garbage collection is called block refreshing and explained in Section 3.
Additionally, we describe the impact of shrink header markers on garbage collection Section 3. For brevity, detailed references to the source code of the Linux driver can be found elsewhere [Zim11, ZSS11]. Valid data that exists in blocks selected for garbage collection will first be copied to another block and thus not be erased.
Garbage Collection can be triggered either from a foreground or a background thread. The trigger within a foreground thread is always a write operation to the NAND.
Background garbage collection is not directly triggered by any foreground thread, but executed even when the device is idle. Background garbage collection typically takes place every two seconds. Interestingly, the behavior of garbage collection does not primarily depend on a device s storage occupancy. Execution rather depends on the current state of blocks regarding the amount of obsolete chunks they hold.
Still, every garbage collection can be performed either aggressively or passively, depending on the device s storage occupancy. Passive background garbage collection only collects blocks with at least half of their chunks being obsolete and only checks blocks at most when searching a block to garbage collect. Foreground garbage collection is executed passively if one quarter or less of all free chunks are located in free blocks and ablock with seven-eighths of its chunks being obsolete can be found.
If no block of the entire flash qualifies for erasure, oldest dirty garbage collection is executed. This type of garbage collection selects the oldest block that features at least one obsolete chunk. It is executed every time background or foreground garbage collection have been skipped due to the lack of qualifying blocks 10 or respectively 20 consecutive times.
Hence, as long as every block of adevice has at least half of its chunks filled with valid data, the only way a block can be garbage collected is through oldest dirty garbage collection or its variant called block refreshing explained below. Aggressive garbage collection occurs if background or foreground garbage collection is performed and a device does not feature enough free blocks to store checkpoint data. Aggressive garbage collection potentially deletes a higher number of obsolete chunks per cycle than passive garbage collection and is triggered if a device features less than a certain threshold of free blocks, where the threshold depends on the size of the checkpoint data [ZSS11].
Summary from aforensic perspective. The scenario where amaximum of obsolete chunks can be recovered and therefore the best case for aforensic analyst requires that during the whole time of its usage adevice features enough free blocks to store checkpoint data and adistribution of obsolete and valid chunks that leads to every block having just more than half of its chunks being valid. Additionally, enough free blocks must be available to ensure that more than one quarter of all free chunks is located within empty blocks.
This results in abehavior in which all blocks are garbage collected as seldom as possible and still feature ahigh number of obsolete chunks that potentially contain evidence. Block refreshing is performed during the first execution of garbage collection after mounting ayaffs2 NAND flash memory device and every times ablock is selected for garbage collection.
Basically, block refreshing is avariant of garbage collection that does not pay attention to the number of obsolete chunks within blocks.
Instead, its goal is to move a block s contents to another location on the NAND in order to distribute erase operations evenly. This technique enables the collection of blocks, even if they completely hold valid chunks. Whenever block refreshing is performed, it selects the device s oldest block for garbage collection, regardless of the number of obsolete chunks within this block. Thus, if the oldest block does not contain any obsolete chunks, block refreshing does not lead to deletion of data, as all the oldest block s chunks are copied to the current allocation block.
Its contents can remain stored on a device for a comparatively long time without being deleted by YAFFS2 s garbage collector. We practically evaluate the effects of shrink header markers on the recoverability of obsolete chunks in Section Best case and worst case scenarios All data written to a YAFFS2 NAND remains stored on the device until the corresponding blocks are erased during execution of garbage collection.
Inthe following, the best case scenario described above is further analyzed for its practical relevance. The simulated NAND featured blocks and each block consisted of 64 pages with asize of bytes. Thus, the device had astorage capacity of 64 MiB. YAFFS2 reserves five of the device s blocks for checkpoint data and uses a chunk size matching the device s page size.
Hence, a chunk had a size of bytes. For ev-. Passive and oldest dirty garbage collection only collect five valid chunks per execution of passive garbage collection. Thus, not every execution of passive garbage collection necessarily leads to deletion of a block. In case a block consisting of 64 pages respectively chunks contains only one obsolete chunk, thirteen executions of passive garbage collection are necessary before the block gets erased.
Once a block has been selected for garbage collection, YAFFS2 does not need to select another block to garbage collect until the current garbage collection block is completely collected. Hence, as soon as a block has been chosen for oldest dirty garbage collection, every subsequent attempt of background garbage collection leads to collection of this block. Given the cycle time of 2 seconds for background garbage collection, even in a best case scenario, a block that features only one obsolete chunk gets erased 24 seconds at most after it was selected for oldest dirty garbage collection.
Due to writing of one obsolete file header chunk on creation of a file and writing of adirectory header chunk for the root directory of the device, this lead to a completely filled block that featured exactly one obsolete chunk. As no write operations were performed after creation of the file, passive garbage collection triggered by a foreground thread was not performed.
Additionally, aggressive garbage collection was ruled out due to only one block of the device being occupied. As the block only featured one obsolete chunk, regular background garbage collection was also unable to select the block for garbage collection. Thus, only after ten consecutive tries of background garbage collection, the block wasselected for oldest dirty garbage collection.
Subsequently, the block was garbage collected every two seconds due to background garbage collection. In our conducted test, the block containing the file is selected for garbage collection six seconds after the last chunk of the block has been written.
This is because of background garbage collection attempts before creation of the file making oldest dirty garbage collection necessary. Therefore, the number of obsolete chunks that can be recovered from a YAFFS2 NAND also depends on the time span between the execution of a file deletion or modification and aforensic analysis.
As shown above,the speed of this movement depends to apart on the occupancy of the device s storage capacity. However, the number and distribution of obsolete chunks on the device and the device ssize have amuch greater influence on the speed of this movement. Passive garbage collection only checks blocks at most when searching a block to garbage collect.
Therefore, it can take longer for a specific block to be selected for garbage collection on a large NAND featuring a high number of blocks than it would on asmaller NAND. For other possible scenarios see Zimmermann [Zim11]. Although recovery of a specific deleted file does not differ fundamentally from recovery of aspecificmodified file, one important difference exists.
YAFFS2 s deleted header chunk is always marked with ashrink header marker. In Table 3, a selection of a block s chunks are depicted. The chunks depicted contain data of files filex and filey. While filex was modified by changing its last chunk s content, filey was deleted.
As can be seen, modification of a file leads to writing of new chunks chunk 4 replacing the chunks containing the now invalid data chunk 1.
However, deletion of a file leads to writing of deleted and unlinked header chunks with the deleted header chunk being marked with ashrink header marker. A best case scenario regarding recovery of a delete file is a scenario in which the deleted file is completely recoverable for the longest time possible. A block containing a chunk marked with a shrink header marker is disqualified for garbage collection until the block gets the oldest dirty block. Therefore, in the best case scenario, the file s deleted header chunk has to be stored in the same block as all of the file s chunks in order to protect the block and respectively the complete file with a shrink header marker.
As a block containing a deleted header chunk can only be garbage collected if it is the device soldest block, it does not need to feature aminimum amount of valid chunks to be disqualified for. After creation of a stable initial state by the garbage collector by deleting all obsolete chunks created during the files creation, we performed the following steps on the device: 1.
Unyaffs2 windows download
Win2K File System Formats. Could not load branches. A block containing a chunk marked with a shrink header marker is disqualified for garbage collection until http://replace.me/18848.txt block gets the oldest dirty block.