File Systems Forensics Section II. Basic Forensic Techniques and Tools CSF: Forensics Cyber-Security MSIDC, Spring 2017 Nuno Santos
Summary! Analysis of file systems! Recovery of deleted files 2
Recall from the last class How do we analyze files contents? 3
What s exactly a disk image?! Disk image is a linearized bit-copy of a given hard disk! Typically stored as a single (large) file Mr. Victor s desktop computer (100GB hard disk) 010101101011110000 Disk image file (100GB size)! A disk image can be stored elsewhere for future analysis 4 2015/16
What do we see if we open a disk image? This is what we see This is what we d expect to see 5 Why this difference? 2015/16
Data is organized on disk in layers of abstraction! Highest level of abstraction is closer to what the user sees:! File is the highest level! Block device is the lowest file file system partition / volume block device disk image! File systems and volumes bridge the gap between layers! Disk images collect a snapshot at the block device level! Contains file data and file system / volume meta-data! Forensic analysts must interpret data bottom up from disk images 6 2015/16
Main challenges in forensic disk analysis! Find visible data! If we collect an image of a disk, how can we make any sense out of it and extract useful data files?! Find deleted data! If data files are deleted, is it still possible to recover them? How? 7
Interpretation of file systems 8
From a disk image, how can we recover its files?! Challenge: abstraction layer is too low level! Disk image files provide snapshot at the disk drive level! How can we interpret the data images in order to view the files and directories in the way we are used to?! For that, we need to understand how the data is organized in storage systems 9
! Most forensic data is stored on hard disc drives! In commercial use since 1956 Hard disks 10
Hard disk basic terminology! Head! Device which reads and writes data on the disk! Track! Individual circles on disk platter where data are located! Cylinder! A column of tracks on a disk drive with 2 or more platters! Sector! An individual section of data on a track the smallest amount of data which can be written to the disk usually 512 bytes! Disk Capacity = #cylinders * #heads * #sectors * sector_size 11
Disk addressing scheme! Arrange every sector of the disk into a sequential array Sector / Block Address: 0 1 209 715 200 Assuming: sector size = 512 bytes, disk size = 100GB! Logical Block Address (LBA)! Independent from the physical geometry of the disk drive! First block on disk numbered 0, next is 1,! Most modern drives use this scheme 12
The disk is the lowest level of abstraction file file system partition / volume disk image block device! Then comes partitions / volumes 13
Partitions! The logical address space of a disk is usually split into collections of consecutive sectors called partitions! Partitions are used in many scenarios, including! Some file systems have max size smaller than hard disks! Many laptops put to sleep store memory on special partition! Separate partitions for booting multiple OSes 14
Partitions from the user s perspective Snapshot of Windows disk management tool 15
Partitioning methods! OS and hardware platform use different partitioning methods! Typical partition systems have tables; entries describe partitions! Table entry has the starting sector, ending sector, and the type of partition! Where is this table actually stored? 16
Partition table is meta-data to be stored on disk! The layout of the partition table on disk is dependent on the partition system employed! The most commonly encountered partition system is the DOS-style partition! DOS partitions are used with: Microsoft Windows, Linux, and IA32-based FreeBSD and OpenBSD systems 17
DOS partitioning scheme! A disk that is organized using DOS partitions has an MBR in the first 512-byte sector! MBR has a partition table with 4 entries, one per partition Master Boot Record A basic DOS disk with two partitions and the MBR 18
Expected layout when opening disk image Address Hex Dec. Description 0x000 0 Bootstrap code area 446 0x1BE 446 Partition Entry #1 16 0x1CE 462 Partition Entry #2 16 0x1DE 478 Partition Entry #3 16 0x1EE 494 Partition Entry #4 16 0x1FE 510 Magic Number 2 Total: 512 Size (Bytes ) Includes the starting LBA and length of the partition Disk 1 MBR Partition 1 (ext3) Partition 2 (swap) Partition 3 (NTFS) Partition 4 (FAT32) 19
We ve covered the partition abstraction layer file file system partition / volume disk image block device! Then comes file systems 20
! How are files stored within a partition?! Problem:! Files are arbitrarily long sequences of bytes! Disks can only write / read fixed-sized sectors File systems! How to map files content to sectors?! Do we require all sectors to be allocated contiguously?! Files must have names. How to associate names to files?! These issues are addressed by file systems 21
The FAT file system! Simple file system popularized by MS-DOS! First introduced in 1977! Most devices today use the FAT32 spec from 1996! FAT12, FAT16, FAT32, etc.! Still quite popular today! Default format for USB sticks and memory cards! Used for EFI boot partitions! Name comes from the index table used to track directories and files named File Allocation Table (FAT) 22
FAT: Where file data is stored! File content is stored in data units named clusters Sectors Clusters 8 Sectors! Sector! Minimum storage size on a hard drive! One pie shaped arc of a platter! Common storage size of 512 Bytes! Established during low-level formatting! Numbered sequentially starting at 1! Cluster! Minimum storage size for a file as determined by file system! Common cluster size is 4096 Bytes (4KB) 8 Sectors 23
FAT: How file data is tracked! The high-level idea is: Clusters! For each file, keep track of:! Its name! The clusters that are allocated to it! The total file size 33& 34& bla bla Name:&file1.dat& Size:&4000&bytes& Clusters:& 8&Cluster"& 8&Cluster$& 35& 36& bla bla bla. 24
FAT: The directory and FAT data structures Clusters Directory entry structures FAT structure file1.dat& 4000&bytes& cluster&34& & 33& 32& 33& file1.dat& Clusters - Cluster 34 - Cluster 36 34& 35& 36& 37& & 36& EOF& 34& 35& The index in the FAT corresponds to a cluster number 36& 25
FAT: Directory entry points to file s first cluster Clusters Directory entry structures FAT structure file1.dat& 4000&bytes& cluster&34& & 33& 32& 33& 34& 36& 34& 35& file1.dat& - Cluster 34 - Cluster 36 36& 37& & EOF& 35& 36& 26
FAT: FAT entry points to next cluster of the file Clusters Directory entry structures FAT structure file1.dat& 4000&bytes& cluster&34& & 33& 32& 33& 34& 36& 34& 35& file1.dat& - Cluster 34 - Cluster 36 36& 37& & EOF& 35& An EOF in the FAT means that the file ending was reached 36& 27
FAT: Multiple files Clusters Directory entry structures FAT structure file1.dat& 4000&bytes& cluster&34& & 33& 32& 33& 34& EOF& 36& 34& file2.txt& 100&bytes& cluster&33& 35& 36& EOF& 37& 35& & 36& 28
FAT: Directory structure! There is a specific data area for the root directory! Subdirectories are stored in clusters like files are Data$Area Boot$Sector FAT Root$Directory Cluster$90 Cluster$200 dir1 90 File1.txt 200 Cluster$with$the$ new$content$ that$was$just$ created$in$the$ directory 201 EOF This$is$more$ data$that$ couldn t$fit$into$ the$first$cluster 29
Layout of a FAT file system! Layout of FAT16 on a volume! There are two additional variants: FAT12 and FAT32 Region for FAT data structures FAT2 for backup Marks blocks free or in-use Linked-list structure to manage large files Region for the directory entries of the root folder (fixed location) Stores basic info about the file system FAT version, location of boot files Total number of blocks Index of the root directory in the FAT Store file and directory data Each cluster is a fixed size Files may span multiple clusters 30
In forensics, need to understand the boot sector 31
! TSK forensic toolkit! Use the fsstat tool Tools to help interpret the boot sector 32
EnCase! EnCase is a very powerful (comercial) tool! Demo: How to analyze MBR & VBR by using EnCase! https://www.youtube.com/watch?v=xqrksukk7ue 33
Summary: To find visible data from a disk image! Use adequate forensic tools to:! Interpret the partition table! Interpret the boot sector layout! Traverse the root directory! Navigate the subdirectories! Open the files 34
By the way! There s a lot more we can learn from the meta-data! E.g., files access times, partition names, file sizes, access permissions, etc.! There s more (and better) file systems out there! NTFS (Windows), EXT2 (Linux), HFS+ (Mac OS X)! There s important differences in storage technology! Especially between hard disks and SSDs 35
Conclusions! To read the contents of disk images, we must understand who data is organized into several layers of abstraction! Interpreting the meta-data of file systems is the first step toward recovering visible file content 36
References! Primary bibliography! Bryan Carrier, File System Analysis, 2005 37
Next class! Operating systems forensics 38