{"id":"https://openalex.org/W2887716345","doi":"https://doi.org/10.1145/3230833.3232808","title":"Forensic APFS File Recovery","display_name":"Forensic APFS File Recovery","publication_year":2018,"publication_date":"2018-08-13","ids":{"openalex":"https://openalex.org/W2887716345","doi":"https://doi.org/10.1145/3230833.3232808","mag":"2887716345"},"language":"en","primary_location":{"id":"doi:10.1145/3230833.3232808","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3230833.3232808","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 13th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3230833.3232808","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5079131505","display_name":"Jonas Plum","orcid":null},"institutions":[{"id":"https://openalex.org/I1325886976","display_name":"Siemens (Germany)","ror":"https://ror.org/059mq0909","country_code":"DE","type":"company","lineage":["https://openalex.org/I1325886976"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Jonas Plum","raw_affiliation_strings":["Siemens AG, M\u00fcnchen"],"affiliations":[{"raw_affiliation_string":"Siemens AG, M\u00fcnchen","institution_ids":["https://openalex.org/I1325886976"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5035677830","display_name":"Andreas Dewald","orcid":"https://orcid.org/0009-0003-2711-4227"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Andreas Dewald","raw_affiliation_strings":["ERNW Research GmbH, Heidelberg"],"affiliations":[{"raw_affiliation_string":"ERNW Research GmbH, Heidelberg","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5079131505"],"corresponding_institution_ids":["https://openalex.org/I1325886976"],"apc_list":null,"apc_paid":null,"fwci":2.467,"has_fulltext":false,"cited_by_count":13,"citation_normalized_percentile":{"value":0.91846439,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"10"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13192","display_name":"Forensic Fingerprint Detection Methods","score":0.9696999788284302,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7669798135757446},{"id":"https://openalex.org/keywords/file-system","display_name":"File system","score":0.7514910697937012},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.7058147192001343},{"id":"https://openalex.org/keywords/computer-file","display_name":"Computer file","score":0.6781697869300842},{"id":"https://openalex.org/keywords/unix-file-types","display_name":"Unix file types","score":0.6013912558555603},{"id":"https://openalex.org/keywords/file-system-fragmentation","display_name":"File system fragmentation","score":0.5950806140899658},{"id":"https://openalex.org/keywords/file-control-block","display_name":"File Control Block","score":0.5039333701133728},{"id":"https://openalex.org/keywords/versioning-file-system","display_name":"Versioning file system","score":0.47597020864486694},{"id":"https://openalex.org/keywords/self-certifying-file-system","display_name":"Self-certifying File System","score":0.43777185678482056},{"id":"https://openalex.org/keywords/microsoft-windows","display_name":"Microsoft Windows","score":0.4182981848716736},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.40575775504112244},{"id":"https://openalex.org/keywords/stub-file","display_name":"Stub file","score":0.30895429849624634},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.24115118384361267}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7669798135757446},{"id":"https://openalex.org/C2780940931","wikidata":"https://www.wikidata.org/wiki/Q174989","display_name":"File system","level":2,"score":0.7514910697937012},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.7058147192001343},{"id":"https://openalex.org/C95637964","wikidata":"https://www.wikidata.org/wiki/Q82753","display_name":"Computer file","level":2,"score":0.6781697869300842},{"id":"https://openalex.org/C21729314","wikidata":"https://www.wikidata.org/wiki/Q7896858","display_name":"Unix file types","level":4,"score":0.6013912558555603},{"id":"https://openalex.org/C26656859","wikidata":"https://www.wikidata.org/wiki/Q4089244","display_name":"File system fragmentation","level":4,"score":0.5950806140899658},{"id":"https://openalex.org/C180500224","wikidata":"https://www.wikidata.org/wiki/Q1412592","display_name":"File Control Block","level":4,"score":0.5039333701133728},{"id":"https://openalex.org/C166807848","wikidata":"https://www.wikidata.org/wiki/Q3445065","display_name":"Versioning file system","level":4,"score":0.47597020864486694},{"id":"https://openalex.org/C82820731","wikidata":"https://www.wikidata.org/wiki/Q2640620","display_name":"Self-certifying File System","level":3,"score":0.43777185678482056},{"id":"https://openalex.org/C508378895","wikidata":"https://www.wikidata.org/wiki/Q1406","display_name":"Microsoft Windows","level":3,"score":0.4182981848716736},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.40575775504112244},{"id":"https://openalex.org/C13674803","wikidata":"https://www.wikidata.org/wiki/Q7627301","display_name":"Stub file","level":3,"score":0.30895429849624634},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.24115118384361267}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3230833.3232808","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3230833.3232808","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 13th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3230833.3232808","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3230833.3232808","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 13th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.6700000166893005,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":6,"referenced_works":["https://openalex.org/W95063818","https://openalex.org/W134076915","https://openalex.org/W345711787","https://openalex.org/W2287128730","https://openalex.org/W2750936636","https://openalex.org/W6603836524"],"related_works":["https://openalex.org/W2098881120","https://openalex.org/W4313226861","https://openalex.org/W1990666357","https://openalex.org/W2600173906","https://openalex.org/W1481669841","https://openalex.org/W4247882433","https://openalex.org/W2058294301","https://openalex.org/W2053136373","https://openalex.org/W2563027287","https://openalex.org/W2097829252"],"abstract_inverted_index":{"In":[0,151],"forensic":[1,142],"computing,":[2],"especially":[3],"in":[4,41],"the":[5,12,35,38,60,76,93,101],"field":[6],"of":[7,14,37,136,176],"postmortem":[8],"file":[9,39,44,64,84,89,94,103,143,167,187],"system":[10,40,104],"forensics,":[11],"reconstruction":[13],"lost":[15],"or":[16],"deleted":[17],"files":[18,163],"plays":[19],"a":[20,133,174],"major":[21],"role.":[22],"The":[23],"techniques":[24],"that":[25,82,108],"can":[26],"be":[27],"applied":[28,110],"to":[29,158],"this":[30,152],"end":[31],"strongly":[32],"depend":[33],"on":[34,113,132,164],"specifics":[36],"question.":[42],"Various":[43],"systems":[45,56,65,90],"are":[46],"already":[47],"well-investigated,":[48],"such":[49,74],"as":[50,59,75,119,121,173],"FAT16/32,":[51],"NTFS":[52],"for":[53,68,87,105,139],"Microsoft":[54],"Windows":[55],"and":[57,66,126,160,179,185],"Ext2/3/4":[58],"most":[61],"common":[62],"Linux":[63],"HFS/HFS+":[67],"macOS.":[69],"There":[70],"also":[71],"exist":[72],"tools,":[73],"famous":[77],"Sleuthkit":[78],"by":[79,91,111],"Brian":[80],"Carrier":[81],"provide":[83],"recovery":[85,144],"features":[86],"those":[88,181],"interpreting":[92],"system's":[95],"internal":[96],"data":[97],"structures.":[98],"APFS":[99,166],"is":[100,109,127],"new":[102],"Apple":[106],"devices":[107],"default":[112],"all":[114],"current":[115],"iOS":[116],"mobile":[117],"devices,":[118],"well":[120],"macOS":[122],"since":[123],"High":[124],"Sierra,":[125],"thus":[128],"currently":[129],"rolled":[130],"out":[131],"large":[134],"number":[135],"devices.":[137],"However,":[138],"APFS,":[140],"no":[141],"methodologies":[145],"have":[146],"been":[147],"developed":[148],"so":[149],"far.":[150],"paper,":[153],"we":[154],"propose":[155],"different":[156],"approaches":[157,172],"identify":[159],"recover":[161],"(deleted)":[162],"an":[165],"system.":[168],"We":[169],"implemented":[170],"our":[171],"proof":[175],"concept":[177],"tool":[178],"evaluate":[180],"against":[182,186],"each":[183],"other":[184],"carving.":[188]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2024,"cited_by_count":1},{"year":2022,"cited_by_count":4},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":3},{"year":2019,"cited_by_count":2}],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2025-10-10T00:00:00"}