Defining and validating forensic standards for ext4 file system

Abstract

Linux operating system is one of the most widely used operating systems in the world .The extensive use of this Operating system necessitates the need of performing the forensic anal-ysis of the file system that is most widely used with this operating system .At the file system level when files are created and deleted the data is still persistent on the file system in some scenarios and some part of the data is still recoverable even after secure deletion the data is persistent and some instances of data can still be recovered from the forensics of the file sys-tem.NIST has not provided any standards to delete the file permanently for different file sys-tems. Due to which the need arises to define the standards for Anti forensics of EXT4 file system. So that even the smallest amount of data cannot be recovered. In this Context a de-tailed research has been conducted on the structure of the file system and multiple scenarios have been created to look for data persistence on the file system.