# Reversing File Access Control Using Disk Forensics on Low-Level Flash Memory
## 5 ACRecovery
### Implementing ACRecovery in EXT Filesystems
#### 5.2.4 EXT: Rollback
The rollback times shown follow a mostly linear pattern, with a slight drop-off from the line at a cache size of 200. This is the expected pattern given that all algorithms provided are in linear time. In addition, rollback proves to be a short process, with a queue of 200 taking less than 2 s on a consistent basis. As the system is convenient to use in addition to not taking a large toll on performance, this once again indicates that the system can be implemented with no major changes. ## 7 Discussion

Naturally, our implementation does not cover every possibility and permutation. There are several future directions and improvements that can be made to the system. We \begin{table}
\begin{tabular}{c c c} \hline
**Type** & **Unmodified** & **Modified** \\ \hline Seq-Read & 1450 kB/s & 1454 kB/s \\ Rand-Read & 1022 kB/s & 1029 kB/s \\ Seq-Write & 912 kB/s & 880 kB/s \\ Rand-Write & 788 kB/s & 773 kB/s \\ \hline \end{tabular}
\end{table} 
Table 1: Throughput comparisons (EXT2). Figure 5: The time needed for rollback (EXT2). Figure 6: The time needed for rollback (EXT3). cover several such improvements and challenges here in detail, and anticipate that even more can be made in the future to improve on the work. **Danger and abuse of power. ** Naturally, a system with the power to undo user actions should be heavily restricted due to its potentially compromising nature. We propose use of a manual hardware switch which can trigger rollback, as the only way to completely guarantee that a command cannot be executed without physical access to the machine is to hard-wire it in. Of course, this comes with its own set of issues. Bringing a physical device relies on the user not forgetting to do so, and needing to retrieve an object increases the time between a rollback being requested and actually carried out. However, since the actions this program is capable of are so powerful, it is necessary to take adequate precautions. **OS write caches**. One issue that came up during testing is the fact that Linux commands often cache writes rather than committing them immediately upon instruction [41]. For example, if a file is copied and then permissions are immediately changed, the original version with unchanged permissions is never written to the drive and thus never cached. Notably, re-mounting the drive commits all pending writes, allowing us to work around this problem in testing. This feature has both upsides and downsides for our work. Favorably, this means that repeating a singular command to change the permissions data will likely only commit one change to the drive, thus preventing one potential strategy to clear the cache. However, as mentioned, an attack that targets a file immediately after creation may not be reversible due to file creation. **Partitions**. The algorithm given in Section 5.1 for locating the partition on the drive is configured to find the first partition. However, future partitions can also be found by changing the following addresses:

1. System type: 0x1c2 - > 0x1d2 (2 nd partition), 1e2 (3 rd partition), or 1f2 (4 th partition) [13]
2. LBA start: 0x1c6 - > 0x1d6 (2 nd partition), 1e6 (3 rd partition), or 1f6 (4 th partition) [13]

This allows users to select which partition on the drive is protected in case of situations such as dual booting for multiple OSes. **NTFS**. New Technology File System [42] was designed for use in Windows NT and is currently used as its primary filesystem after phasing out FAT in the 1990s. NTFS is stored as a series of files on the drive, with even important data such as boot records and metadata stored in the same format. The latest version is NTFS 3.1, released in 2001. This system features a boot record, followed by a list of files and their data. This list is known as the Master File Table, or $MFT, and is stored as the second file on the drive. The file preceding the MFT, $Boot, contains diagnostic information for the drive. NTFS uses a system of \"clusters\" of \"sectors\" of bytes, which are used to catalogue files.