Understanding Android - Practical Mobile Forensics - page 226

tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
/dev/block/nandd /system ext4
rw,nodev,noatime,user_xattr,barrier=0,data=ordered 0 0
/dev/block/nande /data ext4
rw,nosuid,nodev,noatime,user_xattr,barrier=0,journal_checksum,data=ordered,noauto_da_alloc
0 0
/dev/block/nandh /cache ext4
rw,nosuid,nodev,noatime,user_xattr,barrier=0,journal_checksum,data=ordered,noauto_da_alloc
0 0
/dev/block/vold/93:64 /mnt/sdcard vfat
rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro
0 0
/dev/block/vold/93:64 /mnt/secure/asec vfat
rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro
0 0
tmpfs /mnt/sdcard/.Android_secure tmpfs
ro,relatime,size=0k,mode=000 0 0
/dev/block/dm-0 /mnt/asec/com.kiloo.subwaysurf-1 vfat
ro,dirsync,nosuid,nodev,relatime,uid=1000,fmask=0222,dmask=0222,codepage=cp437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro
0 0
Yet Another Flash File System 2 ( YAFFS2) is an open source, single-threaded file sys-
tem released in 2002. It is mainly designed to be fast when dealing with NAND flash.
YAFFS2 utilizes OOB (out of band) and that is often not captured or decoded correctly
during forensic acquisition, which makes analysis difficult. This will be discussed more in
Chapter 9 , Android Data Extraction Techniques . YAFFS2 was the most popular release at
one point and is still widely used in Android devices. YAFFS2 is a log-structured file sys-
tem. Data integrity is guaranteed even in case of sudden power outage. In 2010, there was
an announcement stating that in releases after Gingerbread, devices were going to move
from YAFFS2 to EXT4. Currently YAFFS2 is not supported in newer kernel versions, but
certain mobile manufacturers might still continue to support it.
Flash Friendly File System ( F2FS) was released in February 2013 to support Samsung
devices running the Linux 3.8 kernel ( http://www.linux.org/threads/flash-friendly-file-
system-f2fs.4477/ ) . F2FS relies on log-structured methods that optimize NAND flash
memory. The offline support features are a highlight of this file system. Yet, the file sys-
tem is still transient and being updated.