Digital Forensics. Disk and File System stuff

Transcription

1 Digital Forensics Disk and File System stuff

2 Admin Note odd schedule next week Current events Make up schedule discussion Quiz schedule

3 Carrier's File System Categories Carrier's book referenced by yours 2005 book still top file system forensic book on amazon's best seller list Good discussion of unix/posix based file system levels of abstraction Carries over to windows with minor changes

4 Carrier's file system terms I'll conform to Carrier's terms for this class Disk: physical storage device Flash/harddisk/etc (sorry old school windows people) Volume: a logical/virtual 'disk' as the operating system sees it. Maybe spanning multiple physical disks or simply be part of one File System: The layout of files and metadata in a particular volume. Not the directory structure layout Data Unit Smallest independently addressable amount of data

5 Carrier's file system terms cont'd Metadata Literally 'data about data' Found in disk representations of files Also at higher level in most file formats today Examples? File Name level User level project lets have a look Keep in mind that at this level directories/folders are just a special kind of file.

6 What file systems will you see? On Windows?

7 What file systems will you see? On Windows? NTFS (default) FAT32 (old dos 7.0 standard everyone can read) ReFS (windows 8.1 and server2012 and later) NTFS Handles only 16 exabytes See Guidance and encase are two big name tools in windows digital forensics.

8 What File Systems do you see? On Mac OSX (which is a posix/unix system under it all)

9 What File Systems do you see? On Mac OSX (which is a posix/unix system under it all) HFS(older) HFS+ HFSX (which is case sensitive HFS+)

10 What file Systems will you see? On Linux/Unix?

11 What file Systems will you see? On Linux/Unix? Ext4 (default in most current distros) Still used in mint (top distro on distrowatch) and ubuntu and debian, mint's parents. Ext3 (older) XFS BtrFS New versions of Red Hat server standards OpenSuse (distrowatch's #6) Shares features with window's ReFS

12 What filesystems For ios?

13 What filesystems For ios? HFSX It is an apple product after all.

14 On Android? What File System? What filesystems

15 What filesystems For Android? Android is a linux system underneath everything So ext4 is default Old systems (<=FroYo) used YAFFS - Yet Another Flash File System Older systems used to sometimes use proprietary file systems too. Eg Samsung Galaxy S

16 Journaled file Systems Most filesystems today are journaled Simplified: keeps track of changes so if power loss in middle of operation all is not lost Late 90's linux file systems were not journaled Mid 90's windows systems too. Importance of UPS systems Journals sometimes contain info not found anywhere else

17 Disk Layouts Layout of partitions/volumes on a disk are described in Master Boot Record (MBR) GPT logical block 0 usually sector 0 Max 2 terabytes and 4 primary partitions Some systems require Unified Extensible Firmware Interface (UEFI) [Bios replacement] to run GPT Some backward compatibility with mbr Uses more disk space Supports 8 ZetaBytes

18 Reminder A gigabyte is equal to 1,024 megabytes. A terabyte is equal to 1,024 gigabytes. A petabyte is equal to 1,024 terabytes. An exabyte is equal to 1,024 petabytes. A zettabyte is equal to 1,024 exabytes.

19 Other file containers Virtual Machine disk images Expert Witness Format (E01) Produced by encase see earlier AFF Non-proprietary alternative to E01

20 File Carving The fun stuff What if the file isn't there any more? Carve. What happens when you delete a file? Tell a fun story from there

21 Reading Read chapter 3 in Digital Forensics by Altheide and Carvey