an introduction to file system forensic...

(Corso)

© Università degli Studi di Pavia, Antonio Barili 1

Antonio Barili Laboratorio di informatica Forense Dipartimento di Ingegneria Industriale e dell’Informazione Università degli Studi di Pavia

[email protected]

An Introduction to File System Forensic Analysis

Università degli Studi di Pavia – A. Barili 1

Foreword


Computer Forensics

Incident Response Digital Forensics

(Corso)


An Introduction to File System Forensics

What's in a file? That which we call a file by any other name would smell as sweet


File a record in a public office

or in a court of law

place in a container for keeping records Document

A (digital) representation of information




File System

A data structure that provides persistent archival services to an operating system

(Corso)





Visual Metaphores to deal with the File System

Hierarchical tree of folders containing other folders and/or documents


A drive ! A drive ! My kingdom for a drive !


Persistence

(Corso)



A drive ! A drive ! My kingdom for a drive !


HPA ...

LBA Space

Available Sectors

(0,5-4KB) Spare

Sectors


Is this a volume which I see before me?


The file system does not (usually) deals with drives, but to astraction of them

named volumes

Sectors in a volume need not be consecutive on a physical storage device

(but they appear to be so)

(Corso)



Is this a volume which I see before me?


A volume allocated on a single drive

Two volumes on a single drive

A volume spanning two disks (es. RAID1 )

...


Though this be madness yet there is method in it


A C B D

FS A FS B FS C-D

(Corso)



Screw your boot block to the sticking place


MBR/GPT

MBR: Master Boot Record

GPT: GUID Partition Table




MBR (sector 0)

{ Boot Code

PartitionTable [4]

{ Start CHS, End CHS, Start LBA, Nsect, Type, Flags }

Signature

}

Partition # 1

(Corso)





MBR (sector 0)

MBR offset is specified in the CHS/LBA space

File System Data Structure offsets are specified in the partition (volume) space

Partition # 1




[To probe: Frhed – http://frhed.sourceforge.net]

(Corso)





Reserved Area (1 sect)

Master Index (directory) Area

Data Area (Data Clusters)

Housekeeping data

NOT to be confused with “directory” files


Age cannot wither her (The FAT File System)


FAT is the original file system used in DOS and Windows 9x

Now used in Pendrives and Camera Storage Cards

[To probe: http://dmitrybrant.com/fatwalker]

Reserved Area (1 sect)

FAT Area Data Area

(Corso)








(Corso)



Something is rotten in the state of Denmark (The NTFS File System)


NTFS is the default file system since Ms Windows NT

“Everything is a file”

NTFS provides better resilience to system crashes (e.g. journaling) ...

... and a huge amount of places to hide information (from users)

[To probe: http://dmitrybrant.com/fatwalker]

Boot Sector (cluster 0)

$MFT f00 f01




(Corso)








(Corso)



Men's evil manners live in brass; their virtues we write in water


MBR (sector 0)

Formatting an hard disk overwrites the MBR, but leaves partition content unchanged

Even if both the boot sector and the file system structures are lost or damaged, most files will reside in contiguous clusters an could be carved out by looking at their headers and trailers

Partition # 1




(Corso)








(Corso)



There are more things in heaven and earth, Horatio,

Than are dreamt of in your philosophy.

(William Shakespeare, Hamlet Act 1. Scene V, 1601)

Riferimenti


[Carrier, 2005]

Carrier, Brian, File System Forensic Analysis, Addison-Wesley, 2005

[Sammes, 2007]

Sammes, Tony and Brian jenkinson, Forensic Computing – A Parctitioner’s Guide, 2° Ed, Springer-Verlag, 2007

(Corso)


35

Data Autore Descrizione

06/12/2012 ab

Il contenuto di questo documento riflette esclusivamente le opinioni dell’autore e non impegna in alcun modo l‘Università degli Studi di Pavia.

Il contenuto di questo documento è stato curato al fine di fornire un’informazione accurata sull’argomento trattato, non un parere legale o professionale. Se si necessita di tale parere è necessario rivolgersi ad un professionista competente.

an introduction to file system forensic...

Documents