Abstract: Most of the Linux hosts use the EXT3 file system. The hard disk of EXT3 format can store a large number of suspicious files. It's very important to identify the increase, delete, change operation of the suspect in the documents. Extraction of the modified data is important for the investigation and forensic of the public security organs. The operation traces of different files are analyzed in this paper. The basic structure of the EXT3 log file and a method to extract the file name and the inode node information from the log are studied. Extraction method of operating traces based on inode and a state transition machine are designed. The software can be run directly in the Linux host and complete the trace extraction by scanning the log file. After a lot of practical testing, the software can effectively extract the uncovered traces of operation in EXT3 file system.

Key words: operation trace, extraction, EXT3, journal, inode