{"id":"https://openalex.org/W4405434363","doi":"https://doi.org/10.1186/s42400-024-00287-9","title":"Enabling per-file data recovery from ransomware attacks via file system forensics and flash translation layer data extraction","display_name":"Enabling per-file data recovery from ransomware attacks via file system forensics and flash translation layer data extraction","publication_year":2024,"publication_date":"2024-12-17","ids":{"openalex":"https://openalex.org/W4405434363","doi":"https://doi.org/10.1186/s42400-024-00287-9"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-024-00287-9","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-024-00287-9","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-024-00287-9.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://link.springer.com/content/pdf/10.1186/s42400-024-00287-9.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081358429","display_name":"Josh Dafoe","orcid":null},"institutions":[{"id":"https://openalex.org/I11957088","display_name":"Michigan Technological University","ror":"https://ror.org/0036rpn28","country_code":"US","type":"education","lineage":["https://openalex.org/I11957088"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Josh Dafoe","raw_affiliation_strings":["Department of Computer Science, Michigan Technological University, 1400 Townsend Dr, Houghton, MI, 49931, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Michigan Technological University, 1400 Townsend Dr, Houghton, MI, 49931, USA","institution_ids":["https://openalex.org/I11957088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064945035","display_name":"Niusen Chen","orcid":"https://orcid.org/0000-0001-9173-156X"},"institutions":[{"id":"https://openalex.org/I11957088","display_name":"Michigan Technological University","ror":"https://ror.org/0036rpn28","country_code":"US","type":"education","lineage":["https://openalex.org/I11957088"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Niusen Chen","raw_affiliation_strings":["Department of Computer Science, Michigan Technological University, 1400 Townsend Dr, Houghton, MI, 49931, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Michigan Technological University, 1400 Townsend Dr, Houghton, MI, 49931, USA","institution_ids":["https://openalex.org/I11957088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100427291","display_name":"Bo Chen","orcid":"https://orcid.org/0000-0001-9372-9607"},"institutions":[{"id":"https://openalex.org/I11957088","display_name":"Michigan Technological University","ror":"https://ror.org/0036rpn28","country_code":"US","type":"education","lineage":["https://openalex.org/I11957088"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Bo Chen","raw_affiliation_strings":["Department of Computer Science, Michigan Technological University, 1400 Townsend Dr, Houghton, MI, 49931, USA"],"raw_orcid":"https://orcid.org/0000-0001-9372-9607","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Michigan Technological University, 1400 Townsend Dr, Houghton, MI, 49931, USA","institution_ids":["https://openalex.org/I11957088"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101925944","display_name":"Zhenlin Wang","orcid":"https://orcid.org/0000-0002-0429-4371"},"institutions":[{"id":"https://openalex.org/I11957088","display_name":"Michigan Technological University","ror":"https://ror.org/0036rpn28","country_code":"US","type":"education","lineage":["https://openalex.org/I11957088"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhenlin Wang","raw_affiliation_strings":["Department of Computer Science, Michigan Technological University, 1400 Townsend Dr, Houghton, MI, 49931, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, Michigan Technological University, 1400 Townsend Dr, Houghton, MI, 49931, USA","institution_ids":["https://openalex.org/I11957088"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5100427291"],"corresponding_institution_ids":["https://openalex.org/I11957088"],"apc_list":null,"apc_paid":null,"fwci":1.5213,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.84158101,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"7","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11181","display_name":"Advanced Data Storage Technologies","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7111414670944214},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.6058477759361267},{"id":"https://openalex.org/keywords/file-system","display_name":"File system","score":0.5783072710037231},{"id":"https://openalex.org/keywords/flash-file-system","display_name":"Flash file system","score":0.573270857334137},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.4625629186630249},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.45432060956954956},{"id":"https://openalex.org/keywords/data-extraction","display_name":"Data extraction","score":0.4380512237548828},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.25516363978385925},{"id":"https://openalex.org/keywords/medline","display_name":"MEDLINE","score":0.0642285943031311},{"id":"https://openalex.org/keywords/chemistry","display_name":"Chemistry","score":0.06119373440742493}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7111414670944214},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.6058477759361267},{"id":"https://openalex.org/C2780940931","wikidata":"https://www.wikidata.org/wiki/Q174989","display_name":"File system","level":2,"score":0.5783072710037231},{"id":"https://openalex.org/C27670709","wikidata":"https://www.wikidata.org/wiki/Q5457555","display_name":"Flash file system","level":4,"score":0.573270857334137},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.4625629186630249},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.45432060956954956},{"id":"https://openalex.org/C2777466982","wikidata":"https://www.wikidata.org/wiki/Q5227287","display_name":"Data extraction","level":3,"score":0.4380512237548828},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.25516363978385925},{"id":"https://openalex.org/C2779473830","wikidata":"https://www.wikidata.org/wiki/Q1540899","display_name":"MEDLINE","level":2,"score":0.0642285943031311},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.06119373440742493},{"id":"https://openalex.org/C98986596","wikidata":"https://www.wikidata.org/wiki/Q1143031","display_name":"Semiconductor memory","level":2,"score":0.0},{"id":"https://openalex.org/C92855701","wikidata":"https://www.wikidata.org/wiki/Q5830907","display_name":"Computer memory","level":3,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1186/s42400-024-00287-9","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-024-00287-9","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-024-00287-9.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:digitalcommons.mtu.edu:michigantech-p2-2273","is_oa":true,"landing_page_url":"https://digitalcommons.mtu.edu/michigantech-p2/1274","pdf_url":null,"source":{"id":"https://openalex.org/S4377196391","display_name":"Digital Commons - Michigan Tech (Michigan Technological University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I11957088","host_organization_name":"Michigan Technological University","host_organization_lineage":["https://openalex.org/I11957088"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Michigan Tech Publications","raw_type":"text"},{"id":"pmh:oai:doaj.org/article:1a71b894c335402caca005c04c9739fb","is_oa":false,"landing_page_url":"https://doaj.org/article/1a71b894c335402caca005c04c9739fb","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 7, Iss 1, Pp 1-16 (2024)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-024-00287-9","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-024-00287-9","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-024-00287-9.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7799999713897705,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1728460889","display_name":null,"funder_award_id":"1928349-CNS","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G1770857612","display_name":"SaTC: CORE: Small: Hardware-assisted Self-repairing in Decentralized Cloud Storage against Malicious Attacks","funder_award_id":"2225424","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2686008474","display_name":"CyberCorps Scholarship for Service: Cybersecurity Workforce Preparation","funder_award_id":"2043022","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G415424968","display_name":"SaTC: CORE: Small: Collaborative: Hardware-assisted Plausibly Deniable System for Mobile Devices","funder_award_id":"1928349","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4944025290","display_name":null,"funder_award_id":"2225424-CNS","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G916762044","display_name":null,"funder_award_id":"2043022-DGE","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4405434363.pdf"},"referenced_works_count":21,"referenced_works":["https://openalex.org/W1995261283","https://openalex.org/W2513529237","https://openalex.org/W2559964890","https://openalex.org/W2601591992","https://openalex.org/W2752497163","https://openalex.org/W2765713146","https://openalex.org/W2771936560","https://openalex.org/W2786921024","https://openalex.org/W2808706667","https://openalex.org/W2902458612","https://openalex.org/W2903262936","https://openalex.org/W2923699932","https://openalex.org/W2945824389","https://openalex.org/W3044316786","https://openalex.org/W3184269725","https://openalex.org/W4205110562","https://openalex.org/W4281752694","https://openalex.org/W4315925974","https://openalex.org/W4319079648","https://openalex.org/W4384948742","https://openalex.org/W4388867277"],"related_works":["https://openalex.org/W2366957717","https://openalex.org/W4395116036","https://openalex.org/W2052655979","https://openalex.org/W753420207","https://openalex.org/W2140771828","https://openalex.org/W2360258700","https://openalex.org/W4231931621","https://openalex.org/W2382150570","https://openalex.org/W1853133198","https://openalex.org/W2171116656"],"abstract_inverted_index":{"Abstract":[0],"Ransomware":[1],"attacks":[2],"are":[3],"increasingly":[4],"prevalent":[5],"in":[6,70,84,97],"recent":[7],"years.":[8],"Crypto-ransomware":[9],"corrupts":[10],"files":[11,128],"on":[12],"an":[13],"infected":[14],"device":[15],"and":[16,186,199,207,228,270,300],"demands":[17],"a":[18,54,88,93,122,130,145,169,224],"ransom":[19],"to":[20,53,78,167,243],"recover":[21,36],"them.":[22],"In":[23,115,133],"computing":[24],"devices":[25],"using":[26,273],"flash":[27,45,72],"memory":[28,46],"storage":[29,52,298],"(e.g.,":[30],"SSD,":[31],"MicroSD,":[32],"etc.),":[33],"existing":[34],"designs":[35],"the":[37,42,49,65,71,79,85,102,109,117,159,173,197,202,208,232,244,248,253,278],"compromised":[38],"data":[39,95,156,191,194,238,250],"by":[40,172],"extracting":[41],"entire":[43,50,110],"raw":[44,193,237,249],"image,":[47],"restoring":[48],"external":[51],"good":[55],"prior":[56,242],"state.":[57],"This":[58],"is":[59,112,165,220],"feasible":[60],"through":[61],"taking":[62],"advantage":[63],"of":[64,81,99,105,125,214,261,280],"out-of-place":[66],"updates":[67],"feature":[68],"implemented":[69],"translation":[73],"layer":[74],"(FTL).":[75],"However,":[76],"due":[77],"lack":[80],"\u201cfile\u201d":[82],"semantics":[83],"FTL,":[86,198],"such":[87],"solution":[89],"does":[90],"not":[91],"allow":[92],"fine-grained":[94,153],"recovery":[96,124,157,245,254],"terms":[98],"files.":[100],"Considering":[101],"file-centric":[103],"nature":[104],"ransomware":[106,131,147,160,275],"attacks,":[107],"recovering":[108],"disk":[111],"mostly":[113],"unnecessary.":[114],"particular,":[116],"user":[118],"may":[119],"just":[120],"wish":[121],"speedy":[123],"certain":[126],"critical":[127],"after":[129,158],"attack.":[132,161],"this":[134],"work,":[135],"we":[136,175,222],"have":[137],"designed":[138],"$$\\textsf{FFRecovery}$$":[139,215,262,281,291],"<mml:math":[140,216,263,282,292],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\">":[141,217,264,283,293],"<mml:mi>FFRecovery</mml:mi>":[142,218,265,284,294],"</mml:math>":[143,219,266,285,295],",":[144],"new":[146],"defense":[148],"strategy":[149],"that":[150,221,235,290],"can":[151,255],"support":[152],"per":[154],"file":[155,170,179,183,190,204,209],"Our":[162],"key":[163],"idea":[164],"that,":[166],"restore":[168,177],"corrupted":[171],"ransomware,":[174],"(1)":[176],"its":[178,189],"system":[180,184,205],"metadata":[181,206],"via":[182,192],"forensics,":[185],"(2)":[187],"extract":[188],"extraction":[195],"from":[196],"(3)":[200],"assemble":[201],"corresponding":[203],"data.":[210],"Another":[211],"essential":[212],"aspect":[213],"add":[223],"garbage":[225],"collection":[226],"delay":[227],"freeze":[229],"mechanism":[230],"into":[231],"FTL":[233],"so":[234],"no":[236],"will":[239],"be":[240,256],"lost":[241],"and,":[246],"additionally,":[247],"needed":[251],"for":[252],"always":[257],"located.":[258],"A":[259],"prototype":[260],"has":[267,296],"been":[268],"developed":[269],"our":[271],"experiments":[272],"real-world":[274],"samples":[276],"demonstrate":[277,289],"effectiveness":[279],".":[286],"We":[287],"also":[288],"negligible":[297],"cost":[299],"performance":[301],"impact.":[302]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":3}],"updated_date":"2026-06-13T06:13:01.061226","created_date":"2025-10-10T00:00:00"}