NTFS File System and Data Security. Yanhui Tu. KingSoft

Transcription

1 NTFS File System and Data Security Yanhui Tu KingSoft

2 Index 1 File System kernel analysis 2 Stream and Data security 3 Data recover 4 Date overwrite

3 File There are 2 different kinds Metafiles: user can t access User files: User data

4 NTFSmeta file Metadata $MFT $MFTMirr $LogFile $Volume $AttrDef $Root $Bitmap $Boot $BadClus $Quota(NTFS4) $Secure $UpCase $Extend Metadata directory $Extend\$Reparse $Extend\$UsnJrnl $Extend\$Quota $Extend\$ObjId Function MFT itself Part image of MFT Log file Volume file Attribute definition list root directory Bitmap file Boot file Bad cluster file Quota file Secure file Capitalized file Extended Metadata directory Reparse Points file Log changing file Quota management file Object ID file

5 $MFT(Master File Table ) Includes all information about files, and these information called attributes The NTFS file system contains a file called the master file table, or MFT. There is at least one entry in the MFT for every file on an NTFS file system volume, including the MFT itself

6 Normal file MFT MFT header 10H $STANDARD_INF ORMATION 30H $FILE_NAME 80H $DATA and $BITMAP MFT End

7 Resident attribute and non-resident attribute Resident attribute save data in file data area Non-resident attributes saved in MFT

8 Directory s MFT MFT header 10H(STANDARD INFORMATION) 30H(File Name) 90H(Index Root ) A0H( Index Allocation) B0H(BitMap MFT END

9 Structure of file index Index header (every 4KB index block has a file index header.) Index item(every item record a file s filename, MFT number, parent directory MFT number etc. )

10 $LogFile s MFT log file s structure is very complicated and it s structures details are still unknown

11 $LogFile log file log file s structure is very complicated and it s structures details are still unknown, we only know it s separated into many 4k blocks and each block start with RCRD

12 $LogFile log file recorded a example of file rename

13 Volume file Label in offset 60H

14 $AttrDef file List of record all attributes

15 Content of $AttrDef Records all attributes definition

16 . file (root) Root of directory tree

17 90H attribute of root directory

18 $Bitmap file

19 Content of $Bitmap file

20 $Boot file MFT

21 Content of $Boot

22 Content of $Boot

23 $UpCase file MFT

24 Content of $UpCase file

25 $BadClus file MFT It maintains a list of bad clusters on the drive.

26 Stream and Data Security Put file in stream

27 Stream and Data Security 29A released a stream based virus at 2000 Currently no Anti-virus support stream scaning in China

28 Stream and Data Security Stream in disk

29 Stream and Data Security Stream in disk

30 and Data Security Stream Stream can put in directory

31 Stream and Data Security API designed for stream programing 1 Travel : FindFirstStreamW and FindNextStreamW (Win2003server) BackupRead 和 BackupSeek(Win2000) 2 Delete: DeleteFile And if you can access stream without above APIs with knowledge of NTFS data structure

32 Normally, user access files by using file system, these files store on user s hard disk and organized by file system and supply files to users. What users see are only files, users don t care about how these file stored in disk, they can use commands supplied by OS to read and write files, but if one of data or file system is corrupted user can t access files anymore. Data Recover

33 When file system is corrupt, we have 2 methods to recover data. First method: Rebuild this file system,fix corrupt part, and system can access this file system normally and recover the lost data. For example: When hard disk s partition table is corrupt, we can rebuild partition table to recovery data; If some partitions can t access normally, we can rebuild BPB to fix that. This method is suitable for repairing some of key data, only need very small data of rebuild. Second method: Rebuild lost data to files from source devices. When try to rebuild some extremely unstable file system, like file data unsure before corrupted, or need large mount of data writing. This method is suitable for recovering deleted files, partition format scenarios. Data Recover

34 File Recover Scenario:When files deleted or format but not destroyed file data just deleted some file information on file system and release file spaces.

35 File Deleting Processing Deleting file in FAT 1 Replace first byte of directory s filename area to E5H 2 Mark this directory to unused

36 File Deleting Processing Deleting file in NTFS When deleting a file in NTFS need 3 changes: 1. There is a byte at offset 16H of this file s MFT header. If 0 means this file is deleted, 1 means this file is using, 2 means this is a directory, 3 means this directory is deleted; 2. Parent directory attribute INDEX_ROOT (90H)or attribute INDEX_ALLOCATION (A0H); 3. Set 0 to file s corresponding bits in $Bitmap.

37 Recover Demo FAT recover demo 1 Locate file directory items 2 Analysis directory items 3 Locate data area 4 Save recovered file

38 Recover Demo NTFS label recover 1 locate file MFT 2 MFT attribute analysis 3 locate date erea 4 Save recovered file

39 Data Overwrite (DoD ) M a. Degauss with a Type I degausser b. Degauss with a Type II degausser. c. Overwrite all addressable locations with a single character. d. Overwrite all addressable locations with a character, its complement, then a random character and verify. THIS METHOD IS NOT APPROVED FOR SANITIZING MEDIA THAT CONTAINS TOP SECRET INFORMATION. e. Overwrite all addressable locations with a character, its complement, then a random character. f. Each overwrite must reside in memory for a period longer than the classified data resided. g. Remove all power to include battery power. h. Overwrite all locations with a random pattern, all locations with binary zeros, all locations with binary ones. i. Perform a full chip erase as per manufacturer's data sheets. j. Perform i above, then c above, a total of three times. k. Perform an ultraviolet erase according to manufacturer's recommendation. l. Perform k above, but increase time by a factor of three. m. Destroy - Disintegrate, incinerate, pulverize, shred, or melt. n. Destruction required only if classified information is contained.

40 Data Overwrite Magnetic Tape1 Media Clear Sanitize Type I Type II Type III Magnetic Disk Bernoullis Floppies Non-Removable Rigid Disk Removabel Rigid Disk Optical Disk Read Many, Write Many Read Only Write Once, Read Many (Worm) a or b a or b a or b a, b, or c a, b, or c c a, b, or c c a, b, or m b or m m m m a, b, d, or m a, b, d, or m m m, n m, n

41 Data Overwrite Media Clear Sanitize Memory Dynamic Random Access memory (DRAM) Electronically Alterable PROM (EAPROM) Electronically Erasabel PROM (EEPROM) Erasable Programmable (ROM (EPROM) Flash EPROM (FEPROM) Programmable ROM (PROM) Magnetic Bubble Memory Magnetic Core Memory Magnetic Plated Wire Magnetic Resistive Memory Nonvolatile RAM (NOVRAM) Read Only Memory ROM c or g i i k i c c c c c c or g c, g, or m j or m h or m l, then c, or m c then i, or m m a, b, c, or m a, b, e, or m c and f, or m m c, g, or m m Static Random Access Memory (SRAM) c or g c and f, g, or m

42 D or E level of Overwrite Method 1: 1 Open file 2 Write file 3 Close file Features:Simple but not safe

43 D or E level of Overwrite Method 2: 1 Locate file s MFT or Index in file system 2 Locate file s physical address in disk3 Write disk Features:Complex(need very deep knowledge in file system and disk structure) Safe(can make sure overwrite on same place of file)

44 References 涂彦晖戴士剑. 数据安全与编程技术. 北京 : 清华大学出版社,2005 戴士剑涂彦晖. 数据恢复技术 ( 第 2 版 ). 北京 : 电子工业出版社,2005

45 Thank YOU!