# Reversing File Access Control Using Disk Forensics on Low-Level Flash Memory
## 5 ACRecovery
### Implementing ACRecovery in EXT Filesystems
#### 5.2.4 EXT: Rollback
## 8 Conclusions

In this work, we have designed ACRecovery, a novel scheme which can restore the access control system compromised by a high-privilege adversary. This is accomplished entirely within the flash translation layer, without any assistance from the operating system. By performing forensic analysis over the raw data in the flash memory, we can extract the original access control metadata of the OS, enabling the rollback of the most recent changes on them (due to the out-of-place update mechanism in the FTL). Such a design is necessary for defending against the OS-level adversary which can compromise the operating system and arbitrarily modify the access control metadata in the OS. We have presented the implementation of ACRecovery on EXT2 and EXT3 filesystems, and perform experimental evaluations which show that ACRecovery can roll back the compromised access control metadata in the OS efficiently, without incurring a significant impact on the lifespan and throughput of the flash storage drive. This pioneering research paves the way for future research on filesystem forensics within the FTL, thereby benefiting the data recovery community. Potential followup works include expanding the system to support the FAT and NTFS filesystems as well as extra optimizations of the current design. Conceptualization, C.R. and B.C. ; methodology, C.R. and B.C. ; validation, C.R. and B.C. ; formal analysis, C.R. and B.C. ; investigation, C.R. and B.C. ; writing--original draft preparation, C.R. and B.C. ; writing--review and editing, C.R. and B.C. ; project administration, B.C. ; funding acquisition, B.C. All authors have read and agreed to the published version of the manuscript. This research was funded by National Science Foundation under grant number 2225424-CNS, 1928349-CNS, and 2043022-DGE. Not applicable. **Data Availability Statement**: Our developed prototype and demo video are publicly available in [[https://github.com/NotoriousADC/flashback](https://github.com/NotoriousADC/flashback)]([https://github.com/NotoriousADC/flashback](https://github.com/NotoriousADC/flashback)) (accessed on 5 August 2024). ## Conflicts of Interest: The authors declare no conflict of interest. ## Abbreviations

The following abbreviations are used in this manuscript: \begin{tabular}{l l} ACL & Access Control List \\ CAN & Controller Area Network \\ ECU & Electronic Control Unit \\ EXT & EXTended file system \\ FAT & File Access Table \\ FTL & Flash Translation Layer \\ GPT & GUID Partition Table \\ NTFS & New Technology Filesystem \\ \end{tabular} 

## References

* [1] Foundation, T.L. Understanding Linux Permissions. Available online: [[https://www.linuxfoundation.org/blog/blog/classic-sysadmin-understanding-linux-file-permissions](https://www.linuxfoundation.org/blog/blog/classic-sysadmin-understanding-linux-file-permissions)]([https://www.linuxfoundation.org/blog/blog/classic-sysadmin-understanding-linux-file-permissions](https://www.linuxfoundation.org/blog/blog/classic-sysadmin-understanding-linux-file-permissions)) (accessed on 22 May 2024). * [2] Critical RCE Vulnerability in Linux Kernel Let Hackers Compromise the Entire Systems Remotely. Available online: [[https://cybersecuritynews.com/linux-kernel-bug-3/](https://cybersecuritynews.com/linux-kernel-bug-3/)]([https://cybersecuritynews.com/linux-kernel-bug-3/](https://cybersecuritynews.com/linux-kernel-bug-3/)) (accessed on 6 May 2024). * [3] Microsoft. CVE-2021-34535. Available online: [[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34535](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34535)]([https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34535](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34535)) (accessed on 21 May 2024). * [4] NIST. CVE-2018-4121. Available online: [[https://nvd.nist.gov/vuln/detail/CVE-2018-4121](https://nvd.nist.gov/vuln/detail/CVE-2018-4121)]([https://nvd.nist.gov/vuln/detail/CVE-2018-4121](https://nvd.nist.gov/vuln/detail/CVE-2018-4121)) (accessed on 23 May 2024). * [5] [PERSON].