2015-2017 (c) P.Pale: Computer Forensics 2015-10-17 File System - PowerPoint PPT Presentation

2015-2017 (c) P.Pale: Computer Forensics – 2015-10-17 File System Forensics

„ A New York computer forensics firm found that 40% of the hard disk drives it recently purchased in bulk orders on eBay contained personal, private and sensitive information. ” (Computer World, 2009) http://www.computerworld.com/article/2530795/data-center/survey--40--of-hard-drives-bought-on-ebay-hold-personal--corporate-data.html 2 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

„ Details of test launch procedures for the THAAD (Terminal High Altitude Area Defense) ground-to-air missile defense system were found on a disk bought on eBay. ” (BBC News, 2009) 3 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• Goal of this lecture IS NOT ▪ to teach students how to use modern forensic tools and methods ◦ although they will be mentioned • The goal is to ▪ show them forensics on the most basic level , ▪ give them an insight into how file systems work , ▪ because that is also the foundation of every advanced digital forensic tool • In the course of this lecture ▪ basic concepts of the most popular file systems will be explained ▪ students will get knowledge needed for continuation of further independent file system research 4 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• Student must understand the difference between decimal , hexadecimal and binary number systems and know how to convert numbers from one number system to another ▪ content of Digital Logic course at FER • Differentiate between: ▪ Big-endian ◦ “network byte order” ◦ 2015 10 = 0x07 0xdf ▪ Little-endian ◦ microprocessors ◦ „Intel format” ◦ 2015 10 = 0xdf 0x07 Picture taken from: geekandpoke.typepad.com/.a/6a00d8341d3df553ef01543533e604970c-pi 5 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• In the focus of computer forensics is computer permanent storage ▪ Permanent storage saves data even after the computer is shut down ▪ and has no power ◦ typically: disks , memory cards, USB flash drives, etc. • For computer to manage memory and understand the meaning of every single bit: ▪ Every permanent memory must be formatted ▪ with/to a FILE SYSTEM • While analyzing file systems, the most common goals are: ▪ to find files, ▪ to restore lost or deleted files, ▪ to discover hidden data 6 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

File system is an: ▪ an abstraction , a concept ▪ an organizational schema for permanent memory ▪ it performs functions of ◦ organizing, managing, storing and fetching data ▪ it enables the computer to work with files/data ▪ it is mostly hierarchically organized 7 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

File name File metadata File metadata File metadata File metadata File name File name File name File data File data File data File data • Sequential file system • typical for some (sequential) media: 8 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• but media is still partially sequential • however, it allows for ▪ hierarchical filesystem 9 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

10 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

Different properties and physical layout 11 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• Most common: ▪ Windows: FAT12, FAT16, FAT32, exFAT, NTFS ▪ UNIX: ext, ext2, ext3, ext4 • Other: ▪ Mac OS: HFS, HFS+ ▪ CD/DVD: ISO9660, UDF ▪ JFS, ReiserFS, XFS, UFS ▪ Google File System, Hadoop Distributed File System ▪ etc . 12 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• When the computer is started , • typically it is looking for some kind of permanent memory ▪ usually the hard disk , but it can also be ◦ CD/DVD, flash drive, … • from which it reads further instructions ▪ a computer program ◦ to load into memory ◦ and run it • But, how does the computer know which file system the memory uses? • Where does it look for startup instructions ? 13 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• For the purpose of better organization and easier management, every permanent memory is divided into SECTORS ▪ memory chunks, fixed size of 512 bytes • On the first physical sector of the memory, computer expects MASTER BOOT RECORD ▪ MBR for short 14 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

MBR is 512 bytes, and consists of three parts: 1. Bootstrap code , 446 bytes 1 2. Partition table, 4 * 16 bytes = 64 bytes 2 3. Boot signature , 2 bytes = 0x 55 0x AA 3 64 bytes 2 bytes 446 bytes 1 2 3 This diagram is NOT proportional! 15 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

Bootstrap code Partition table Boot signature 16 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

1 Stage One • executable code (program) with following tasks: 1. find an active partition ◦ by scanning partition tables, 2. read the first sector of the active partition, 3. copy the program found there to the working memory and 4. start the program which was loaded 17 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

2 • Partition ▪ is one part of the physical disk ◦ can be viewed as a logical, smaller disk ▪ useful to separate ◦ system SW from data or ◦ multiple (different) operating systems, ◦ area for swapping/paging (for OS) etc. ▪ helps if parts of disk (content) are damaged • MBR has 4 entries for partition ▪ each one 16 bytes long • Every partition entry contains the fields with data that tell us: ▪ is the partition active? ▪ with which file system was partition formatted ▪ on which sector the partition starts ▪ how big is the partition 18 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• CHS is short for Cylinder – Head – Sector • these fields are only relevant if permanent storage is hard drive – no cylinders and heads on flash memory or SSD disks • for historical reasons 19 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• Primary partitions (max 4) • Extended partition (max 1) ▪ extended boot record (EBR) ▪ extended partition boot record (EPBR) • First sector contains EBR ▪ EBR is similar to MBR ▪ but only first two partition table entries are used ◦ First describes this logical partition ◦ Second describes where next extended partition starts ▫ thus, a linked list of (unlimited #) partitions can be created 20 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

3 • at the end of MBR • a field of 2 bytes , ▪ always contains the value 0x 55 0x AA • indicates that MBR ends there • The way to check whether ▪ MBR is there at all ▪ and is valid 21 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

1. Only 4 partition entries in partition table ▪ limit the disk to only 4 physical partitions ◦ it can be somewhat solved by creating extended/logical partitions 2. Field for partition size in partition table is 32 bits long, which means that maximal partition size is 2 32 sectors of 512 ▪ bytes , or 2 TiB • To counter these potential problems, an alternative to Master Boot Record was invented: ▪ GUID Partition Table (GPT) 22 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• new standard that gradually replaces MBR ▪ Linux, Mac OS X, Windows 8.x & 10 • the name comes from the fact that ▪ every partition has globally unique identifier (GUID) • unlike MBR ▪ no restrictions on the number or size of partitions • unlike MBR ▪ which is stored only in one place in the memory, ▪ GPT stores copies ◦ throughout the whole disk, ◦ ensuring the disk consistency 23 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

Second stage • Thus, the MDR’s boot code ▪ looks into the partition table ▪ to find the one designated as “active”, bootable ▪ which file system was used to format the partition ◦ 0x07 = NTFS ◦ 0x83 = Linux http://datarecovery.com/rd/hexadecimal-flags-for-partition-type/ ◦ many codes = FAT ▪ and where is it located ◦ which sector it starts at ▫ counting from the beginning of the disk ▪ then again reads the first sector ◦ and possibly next few • that program than reads the bootloader This is where file systems ▪ looks for the file in the file system start to differentiate and starts that application- the bootloader 24 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics

• bootloader ▪ completely “understands” particular file system • and looks in it for the operating system kernel • loads it into RAM • and starts it 25 2015-10-17 2015-2017 (c) P.Pale: Computer Forensics – File System Forensics