Mapping the File Systems Genome: rationales, technique, results and applications

TL;DR

This paper introduces the concept of File System Genome as a unique HDD feature, demonstrating its potential for identification and security applications through experimental and information theory analysis.

Contribution

It presents the first systematic study of File System Genome, showing its uniqueness across HDDs and proposing its use in forensic and security contexts.

Findings

File System Genome is unique to each HDD.

Different OS installations on identical hardware produce different genomes.

Information theory metrics reveal significant differences between genomes.

Abstract

This paper provides evidence of a feature of Hard-Disk Drives (HDDs), that we call File System Genome. Such a feature is originated by the areas where (on the HDD) the file blocks are placed by the operating system during the installation procedure. It appears from our study that the File System Genome is a distinctive and unique feature of each indi- vidual HDD. In particular, our extensive set of experiments shows that the installation of the same operating system on two identical hardware configurations generates two different File System Genomes. Further, the application of sound information theory tools, such as min entropy, show that the differences between two File System Genome are considerably relevant. The results provided in this paper constitute the scientific basis for a number of applications in various fields of information technology, such as forensic identification and security. Finally, this work also paves the way for the application of the highlighted technique to other classes of mass-storage devices (e.g. SSDs, Flash memories).