Extedig The Sleuth Kit ad its Uderlyig Model for Pooled File System Foresic Aalysis Frauhofer Istitute for Commuicatio, Iformatio Processig ad Ergoomics Ja-Niclas Hilgert* Marti Lambertz Daiel Plohma ja-iclas.hilgert@fkie.frauhofer.de marti.lambertz@fkie.frauhofer.de daiel.plohma@fkie.frauhofer.de Frauhofer FKIE
Digital Foresic Aalysis Slide 2 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
File Systems Defie how data is read from ad writte to a storage device Utilize metadata to keep order of the data stored File systems differ i may aspects NTFS EXT2FS HFS Extesive backgroud kowledge is required for a foresic aalysis But ot always existet Slide 3 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
File System Foresic Aalysis De-Facto Stadard Model Physical Media Aalysis Sectors of Data Uiversal model for a file system foresic aalysis Aalysis Preseted by Bria Carrier i 2005 Cosists of four iterdepedet steps Implemeted i The Sleuth Kit File System Aalysis File Applicatio Aalysis Slide 4 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
File System Foresic Aalysis De-Facto Stadard Model Physical Media Aalysis Sectors of Data Works great o a lot of established file systems EXT2FS Aalysis NTFS HFS File System Aalysis File Problem: It has t bee reviewed or chaged sice its publicatio Applicatio Aalysis Slide 5 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
File System Foresic Aalysis Tryig TSK o ZFS jhilgert:zpool$ fsstat disk1 Caot determie file system type Slide 6 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Pooled File Systems Old File System Mappig FAT32 NTFS Ext4 Block Block Block devices (hard drives, solid state drives...) are somehow used to create ew block devices Oe file system is assiged to oe of these block devices Slide 7 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Pooled File Systems New Approach Pool s are combied to form a storage pool Its cofiguratio depeds completely o the implemetatio File systems share the available space from the storage pool Slide 8 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Requiremets Detect Pool Members Pool Slide 9 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Requiremets Detect Pool Members Pool Slide 10 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Requiremets Detect Pool Cofiguratios Pool Slide 11 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Requiremets Aalyze a Complete Pool Pool Slide 12 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Requiremets Access Correct Offsets o Physical Disks Pool Slide 13 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Requiremets Access All Data Pool Slide 14 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Requiremets Deal with Icomplete Pools Pool Slide 15 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
File System Foresic Aalysis Phyiscal Media Aalysis Physical Media Aalysis Sectors of Data Acquisitio of data from storage devices Aalysis Data is oly see as a sequece of bytes No chage ecessary File System Aalysis File Applicatio Aalysis Slide 16 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
File System Foresic Aalysis Applicatio Aalysis Physical Media Aalysis Sectors of Data Performs a applicatio-level aalysis of the acquired files Aalysis Works o already recovered ad collected files File System Aalysis File No chage ecessary Applicatio Aalysis Slide 17 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Aalysis Physical Media Aalysis Sectors of Data Data is searched for its uderlyig volume structure Aalysis Returs detected volumes (block devices) File System Aalysis File Applicatio Aalysis Slide 18 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Aalysis Physical Media Aalysis Sectors of Data Pooled storage file systems implemet their ow volume maager Aalysis Established volume maagers are still used s ca also be part of a pool File System Aalysis File aalysis is still ecessary Applicatio Aalysis Slide 19 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Pool Aalysis Physical Media Aalysis Sectors of Data Aalysis Recostructed Pool File Pool System Aalysis File s or data eed to be aalyzed for possible pool membership Usig the file systems volume maager results i a recostructed pool Applicatio File System Aalysis File Oly high-level access No file system aalysis possible Applicatio Aalysis Slide 20 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Pool Aalysis Physical Media Aalysis Sectors of Data Aalysis Recostructed Pool Pool Aalysis Pool (Direct Access) Pool Member File system data ad metadata is essetial for a file system aalysis Direct access to the pool ad its members is required File System Aalysis File Mappig schema of the file system eeds to be kow Applicatio Aalysis Slide 21 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Pool Aalysis Physical Media Aalysis Sectors of Data Aalysis Recostructed Pool Pool Aalysis Pool (Direct Access) Pool Member s do ot eed to be part of a pool Importat: Pool aalysis is file system depedet File System Aalysis File Applicatio Aalysis Slide 22 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model File System Aalysis Physical Media Aalysis Sectors of Data Aalysis Recostructed Pool Pool Aalysis Pool (Direct Access) Pool Member Each volume is searched for a file system File system aalysis ca be performed o the pool with direct access File System Aalysis File Applicatio Aalysis Slide 23 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Extesio of the Stadard Model Exteded Model Physical Media Aalysis Sectors of Data Aalysis Recostructed Pool Pool Aalysis Pool (Direct Access) Pool Member Prototypically implemeted for ZFS File System Aalysis File Applicatio Aalysis Slide 24 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Pooled File Systems ZFS Maagemet First preseted i 2003 (more tha a decade ago) Available for major platforms like Solaris, FreeBSD, Liux, MacOS ZFS combies multiple volumes ito a storage pool Pool members are idetified by four vdev-labels L1 L2 Data L3 L4 (Vdev) Slide 25 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Pooled File Systems ZFS Maagemet Pools i ZFS cosist of oe or more top-level virtual devices (vdevs) Data is striped across all of these top-level vdevs Data ZFS Pool Top-Level Vdev Top-Level Vdev Top-Level Vdev Slide 26 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Pooled File Systems ZFS Maagemet Top-level vdevs are made up of childre Differet types of top-level vdevs are supported by ZFS Each top-level vdev is addressed usig its ID ZFS Pool Top-Level Top-Level Top-Level Mirror Disk / File RaidZ Vdev ID: 0 Vdev ID: 1 Vdev ID: 2 Child Child Child Child Child Child Slide 27 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Pooled File Systems ZFS Geeral Structure is represeted i a tree-structure Überblock is the head of this tree Überblock Überblock Utilizes the copy-o-write priciple Metadata Metadata Metadata Data Data Data Data Data Block poiters refer to variable-sized blocks of data Data is addressed by usig Data Virtual Addresses (DVAs) Top-level Vdevs Mappig Offsets Slide 28 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Evaluatio Evaluatio Pool Use multiple umbers of disks i multiple cofiguratios Two simple disks Oe mirror with two childre Oe raidz1 with three childre EvaluatioPool disk disk mirror raidz1 Slide 29 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Cotributio & Future Research Extesio of The Sleuth Kit for pooled storage file systems Digital foresic aalysis of ZFS Accessig older versios of the ZFS copy-o-write tree Dealig with icomplete pools Further ivestigatios o other ZFS structures: ZFS Itet Log (ZIL) L2ARC Implemetatios for other pooled storage file systems BTRFS, ReFS, APFS Slide 30 Cyber Aalysis & Defese Departmet, Frauhofer FKIE
Thaks for your attetio! https://github.com/fkie-cad/sleuthkit Slide 31 Cyber Aalysis & Defese Departmet, Frauhofer FKIE