While analyzing a dd image from an Android phone (which uses the YAFFS2 file system), I came across the following string many times (43 to be precise) when viewing the image in hexedit:
silly old name
So I looked at the Android source code and discovered that in in kernel/fs/yaffs2/yaffs_guts.c there is a function yaffs_UpdateObjectHeader which updates the header on NAND for an object. In this function, the old name of the object is replaced with the text “silly old name”. I’ll have to study it more to understand the impacts on recovering deleted file meta data but I my initial reaction was:
silly (clever) developer
It made me smile to come across this info…little gems in a huge pile of 1’s and 0’s.
