A method for reconstructing the FAT file system from flash memory

The file system reconstruction is an effective way of recovering the forensic data from Flash memory. However, the traditional reconstruction methods need a precondition that is there are both the logical image and the physical image of flash memory at the same time and that is usually not satisfied in practice. In this paper, we propose a method for reconstructing the File Allocation Table (FAT) file system of Flash device when only a physical image of Flash memory is acquired. After introducing the statistical methods to identify the logical address bytes and the page state byte from the physical image, we propose the new algorithm to reconstruct the newest FAT file system which is based on the newest value of the page state. At last, take the special flash devices with MTK6229 controllers as examples, we expound the methods related to reconstructing the FAT file system and verify the reconstruction algorithm.