Greetings,
Does anyone have any code available for pulling apart and analyzing a YAFFS or YAFFS2 file system? This isn't in TSK, I checked. I'd be happy with C, perl, python ….. I'm trying to avoid recreating the wheel.
Thanks.
_David
David,
Did you get any joy on this request? I worked on a dump from an Android phone recently, and wasn't able to do anything with it but keyword searches. Even tried (and failed) to get the YAFFS2 kernel patch to install on Fedora 11. Did you find any tools for this at all?
Thanks
John
John,
I managed to develop some code that would generate a file list but was unable to recover the files themselves. I tabled the project awhile ago but could go invest some time in moving it forward if there was significant interest.
-David
I have also done work recently on android based phone.
Have you tried to mount the filesystem under ubuntu etc (this is possible)? See if you can use somthin like autopsy Recovering files such as messages and contacts may be a bit tricky knowing how the phone stores all contacts.
Greetings,
I added YAFFS2 support to a CentOS machine. You should be able to do the same thing for any Linux distro. The YAFFS2 file system is well documented and someone could add support for it to existing tools if they were so inclined.
-David
Just wanted to resurrect this and ask if anyone knows of any Windows-based tools for looking at YAFFS and YAFFS2. Not work related, just curious.
Greetings,
I added YAFFS2 support to a CentOS machine. You should be able to do the same thing for any Linux distro. The YAFFS2 file system is well documented and someone could add support for it to existing tools if they were so inclined.
-David
Did you manage to mount a YAFFS volume?
Interestingly, it seems that from Gingerbread Android is moving towards ext4
"The reason this should be of concern to Android developers is that with 2.3, an increasing proportion of devices, notably including the Nexus S, are going to be moving from YAFFS to the ext4 filesystem…"
http//
Thanks for that Alex. I had missed that previously. I wonder if this will be enforced for older phones too or only for new phones from this point forward. Either way, it makes things a little easier for reading the FS.
It will also change the way that the handset interacts with the flash chip. YAFFS2 does it's own wear leveling, presumably for ext4 it'll be dealt with at hardware level. Which for us (despite the difficulties that YAFFS posed) seems the tougher position if you're looking for previous blocks at the rawest level.