Dissecting Files. Endianness. So Many Bytes. Big Endian vs. Little Endian. Example Number. The "proper" order of things. Week 6

Transcription

1 Dissecting Files Endianness Week 6 The "proper" order of things So Many Bytes So Many Bytes On a 32-bit system, each word consists of 4 bytes So, when any 32-bit value is stored in memory, each of those 4 bytes must be stored However, question remains: What order do we store them? Do we store the least-significant byte first, or the most-significant? As long as a system always follows the same format, then there are no problems but different system use different approaches 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer Big Endian vs. Little Endian Example Number Big-Endian approach store the most significant byte (largest value) first used by Motorola, PowerPC Little-Endian approach store the least significant byte (smallest value) first used by Intel appears "backwards" in editors Most significant Byte 2,309,737, AB CD EF Least significant Byte 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer

2 Big Endian vs. Little Endian No "End" to Problems Big Endian AB 2 CD 3 EF 89 AB CD EF There is a problem... if two Little Endian EF CD AB 89 systems use different formats, data will be interpreted wrong! For example: a little-endian system reads a value stored in big-endian a big-endian system reads a value stored in little-endian 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer Endianness in File Formats So who is correct? Adobe Photoshop - Big Endian Windows Bitmap (.BMP) - Little Endian GIF - Little Endian JPEG - Big Endian Is the Intel Pentium (little endian) or the PowerPC (big endian) correct? In reality neither side is correct both formats are equally correct 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer Gulliver's Travels File Headers Knowing the file by its meaty guts 7/28/2018 Sacramento State - Cook - CSc Summer

3 File Signatures File Signatures A filename is a vital helps identify both the name (and thus contents) of the file Windows and the Internet, use the file extension to identify the type of file If the extension is changed or the file name is lost, Windows can't identify the file type & automatically open it 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer File Signatures File Signatures Fortunately, a file can often be identified by looking its binary contents Most file types contain a header the start of the file is used to store metadata - information about the file s contents e.g. width of an image, color palette, etc simpler files (such as plain text files) do not have a header but most do Often the header of a file contains the actual name of the file type in ASCII text! which makes it identifiable by looking at the raw bytes The header (plus any bytes in the file s body) that be used to uniquely identify the file type is referred to as the file signature 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer Analyzing Files Unallocated Files To analyze the raw contents of a file, you need a hex editor This tool displays the bytes in hexadecimal format allowing you to see every byte Often the tools can help you interpret the raw data, but this varies greatly between tools When investigating a hard drive, understanding file signatures is vital If the file is found in a hard drive s unallocated space, there might be vital information missing the original name of the file good luck. the file type the size of the file how many bytes are there? The file s signature can be used to interpret the data and make it recoverable 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer

4 JPEG Very photogenic! JPEG Files JPEGs are stored using in the JPEG File Interchange Format (JFIF) The file header contains information about the density of the picture (pixels per inch/cm) It also can contain a embedded thumbnail it is stored as a true color uncompressed image so, all JPEGs can contain two images it can be used to hide steganographic data 7/28/2018 Sacramento State - Cook - CSc Summer JFIF Signature JFIF Signature JPEGs start with 4 bytes: FF D8 FF E0 Next, there are 2 bytes which will contain different values depending on the file The next 4 bytes contain the text JFIF JFIF Signature Signature Bytes FF D8 FF E A How it Appears ÿ Ø ÿ à J F I F 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer JFIF Header JFIF File Format Field Size Description Header marker 2 First two bytes are always FF D8 Application marker 2 Always FF E0 Length 2 Size of the header Identifier 5 JFIF" + a byte containing 00 Version 2 The first byte is the major version; second is minor Scale 1 Specifies whether inches or centimeters are used X density 2 Pixels per inch/centimeter Y density 2 Pixels per inch/centimeter Thumb width 1 Horizontal size of embedded thumbnail in pixels Thumb height 1 Vertical size of embedded thumbnail in pixels Thumb data varies Uncompressed 24 bit thumbnail Varies depending the size of the header JFIF Can contain steganographic data 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer

5 Exchangeable Image File format Exchangeable Image File format There are several extensions to the classic JFIF format - the most notable is the Exchangeable Image File format (EXIF) It is used to store considerable information about the image such If present, it is definitely of interest of investigator Some of the data that is stored: make and model of the digital camera time and date the picture was taken distance the camera was focused at GPS where the picture was taken (if applicable) serial numbers 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer GIF Files GIF Files A legend of the Internet GIFs were created by CompuServe in 1987 to use with its online software The format is popular today to create simple images and basic animation There are actually two versions of the file GIF 87 Original format, no animations GIF 89 Animation! 7/28/2018 Sacramento State - Cook - CSc Summer GIF Files GIF Signature The file format allows a number of features: multiple images (each can have its own palette) timing and placement control looping simple iteration, nothing fancy transparency comments! Comments are hidden often used to save information about the generating software can be used to hide a secret message remember Base64 GIF signature is easy to spot First six bytes contain the text GIF87a This is slightly different for GIF 89, which contains GIF89a GIF Signature Signature Bytes How it Appears G I F 8 7 a 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer

6 GIF Signature GIF Header Field Size Description Identifier 6 GIF87a or GIF89a Width 2 Total width of the image Height 2 Total height of the image Global Palette size colors Transparent Index 1 Index into the palette that will be transparent Aspect ratio 1 Always zero Global Palette varies Uncompressed 24 bit values 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer GIF Header Always the same 6 bytes for GIF87 or GIF89 PNG Files Contains a various items The bling-bling of pngs! 7/28/2018 Sacramento State - Cook - CSc Summer PNG Files PNG Files PNG (pronounced Ping ) is a relatively new file format It was designed to replace other bitmap file formats and work with the Internet It is also backwards and forwards compatible and easily extendable As a result, this format is designed to work forever PNGs support nearly all the features found in other graphics files with the exception of animation however, this can be added in the future Some features: True color or palette Supports translucency (not just transparency) Store unlimited meta-data about the image 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer

7 PNG Signature PNG Signature PNG headers contain bytes designed so computers will not mistake it for a text file After the initial byte, the header contains PNG This is followed by four control characters PNG Signature Signature Bytes E 47 0D 0A 1A 0A How it Appears P N G 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer PNG Chunks PNG File Format Following the first 8 bytes, a PNG file can contain any number of chunks Each chunk starts a 4 byte chunk length. So every chunk can contain up to 4,294,967,296 bytes contains a 4 byte ASCII identifier are backwards and forwards compatible. If a PNG reader does not understand a chunk identifier, it skips the section it also contains a CRC error check 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer PNG Chunks Critical Chunks Chunks are classified into 2 categories Critical Chunks are necessary to identify the image, set bounds and other items that must be included. Ancillary Chunks help the image, but are not required. They can be safely ignored though the image might not look correct if a chunk type is not recognized, it will be ignored Type IHDR PLTE IDAT IEND Contents The true header is contained in this chuck. This is required and is the first chunk If the image uses a palette, this chunk contains the table The image data This chunk marks the end of the file 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer

8 Ancillary Chunks Just a few Text Ancillary Chunks Type bkgb chrm gama sbit time trns Contents Default background color Chromaticity settings (for color correction) Gamma information Color accuracy Time stamp for the image Transparency information PNGs can contain a number of hidden text fields these are used to store comments, information about the image, or anything the user needs these can be used to store hidden data (Base64) Since unrecognized chunk types are ignored, fake chunks can be snuck into a file and used to store hidden data So, in addition to the least-significant bit method, there other ways to hide data in PNGs 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer Ancillary Text Chunks Graphics File Signature Summary Type Contents itxt Unicode text. This can be compressed text Stores text with a key = value time format. This allows image attributes to be stored similar to how to INI values. The format uses a 00 byte rather than an equals ztxt Compressed version of text File Type Signature How it Looks JPEG FF D8 FF E A GIF GIF87a GIF89a ÿøÿà JFIF PNG E 47 0D 0A 1A 0A PNG BMP 42 4D BM 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer File Carving File Carving Do you want the light bytes or the dark bytes? Even, if the file is found partially on a hard disk, it can still be recovered using a process data carving or data salvaging Header can contain info about the total size of the file this is vital to know how many bytes to copy 7/28/2018 Sacramento State - Cook - CSc Summer

9 Review: Hard Disk Technology Review: How Data is Organized The data is stored in circles which we call tracks Each track is divided into small pieces called sectors. Most disks store 512 bytes to a sector Disks contain enormous numbers of sectors so a file system groups several into a cluster 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer Hard Disk Clusters Unallocated Space Deleted File Header Signature Cluster Sector Deleted File 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer Reconstructing Files Continuous File Basically, you need to find the all used clusters fortunately, these are usually continuous on the hard disk but not necessarily on nearlyfull volumes Then, export the clusters (in the correct order) and reconstruct them into a new file To restore the file, copy the used sectors and store it a new file The signatures (header and possibly one in the body) can be used to identify the type 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer

10 Fragmented File File Repair Finding the next cluster, for fragmented files, can be difficult Fortunately, often the file s body (depending on the type) can have signatures Using these signatures, you can find the next cluster Sadly, when cluster is overwritten the start of the cluster is overwritten first this is the beginning of the previous file so essentially the header is the first casualty First, try to open the file normally the software might compensate for the damage 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer File Repair File Repair However, this is not always the case You will need to reconstruct the file so it can be viewed So, you need to: recover more pieces of file if needed examine file header & repair it test the corrected file A new header, can be carefully created and combined with the partial file to create a new complete file This is called grafting, and is not easy 7/28/2018 Sacramento State - Cook - CSc Summer /28/2018 Sacramento State - Cook - CSc Summer Destroyed File Header A file may be partially overwritten You have to repair (graft) the missing sections! If the header is destroyed, you must rely on other signatures to identify the file 7/28/2018 Sacramento State - Cook - CSc Summer