ad hoc file system forensics
play

Ad-hoc File System Forensics Andreas Schuster 1 Introduction - PowerPoint PPT Presentation

Feb 07, 2024 •286 likes •564 views

Ad-hoc File System Forensics Andreas Schuster 1 Introduction Standard Operating Procedure Extract disk drive Connect to write-blocking device Create image Load image into analysis software Analyze! 2 Introduction But how

  1. Ad-hoc File System Forensics Andreas Schuster 1

  2. Introduction Standard Operating Procedure  Extract disk drive  Connect to write-blocking device  Create image  Load image into analysis software  Analyze! 2

  3. Introduction But how about printers?  Printer  Scanner  Photocopier  Fax  File server  Web server  ... and it is equipped with a disk drive! 3

  4. Introduction Standard hardware?  Carrier plate  Standard ATA disk  Apply Standard Operating Procedure  Extract disk drive  Connect to write-blocking device  Create image  Load into analysis software 4

  5. Introduction Unrecognized file system - now what? 5

  6. Analysis Process 1. Physical disk examination 2. Volume examination 3. File system layout 4. File name information 5. File metadata 6. File content 6

  7. Physical Disk Examination Tools  Tableau write-blocking ATA/FW bridge  Tableau Disk Monitor http://www.tableau.com/  tableau-parm http://projects.sentinelchicken.org/tableau-parm

  8. Physical Disk Examination Disk Information Vendor (empty) Model HP J6054B Revision AD101A Serial number 169V0029T Bus type IDE Device type Simplified Direct Access Removable media? No Sector size 512 bytes HPA in use? Yes DCO in use? No Security extensions in use? No Reported capacity 37,1 GB (77.878.016 sectors) HPA capacity 37,3 GB (78.140.160 sectors) DCO capacity 37,3 GB (78.140.160 sectors)

  9. Volume Examination Tools  TestDisk by Christophe Grennier http://www.cgsecurity.org/wiki/TestDisk  Available for MS Win, Linux, *BSD, SunOS, Mac OS X  Override disk geometry parameters for a really deep scan  sectors = 1  heads = 1 9

  10. Volume Examination Testdisk 10

  11. Shannon‘s Entropy Assumptions  Alphabet of 256 characters  1 byte per character  Block size >> size of alphabet 11

  12. Shannon‘s Entropy Tools  Python http://www.python.org/  SQLite http://www.sqlite.org/  Gnuplot http://www.gnuplot.info/ 12

  13. Shannon‘s Entropy 1 st attempt gnuplot> set style data dots gnuplot> set datafile separator "|" gnuplot> plot "< sqlite3 myfile.db3 'SELECT * FROM tbl_entropy WHERE offset BETWEEN 0 AND 1*512*1024*1024;'" notitle 13

  14. Shannon‘s Entropy Plot of first 512 MiB 14

  15. Shannon‘s Entropy Zoom in on the first sectors gnuplot> set style data dots gnuplot> set logscale x 10 gnuplot> set datafile separator "|" gnuplot> plot "< sqlite3 myfile.db3 'SELECT * FROM tbl_entropy WHERE offset BETWEEN 0 AND 1*512*1024*1024;'" notitle 15

  16. Shannon‘s Entropy Plot of first 512 MiB 16

  17. Shannon‘s Entropy Add a bit of color gnuplot> set style data impulses gnuplot> set cbrange [0:8] gnuplot> set logscale x 10 gnuplot> set datafile separator "|" gnuplot> plot "< sqlite3 myfile.db3 'SELECT * FROM tbl_entropy WHERE offset BETWEEN 0 AND 1*512*1024*1024;'" notitle palette 17

  18. Shannon‘s Entropy Plot of first 512 MiB 18

  19. Area 1 MBR followed by blank sectors $ hexdump -C -n 32768 -s 0 4100_spool.001 00000000 00 00 00 48 50 75 78 31 2e 30 30 00 00 00 00 00 |...HPux1.00.....| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000001c0 00 00 40 00 00 00 3f 00 00 00 11 4f a4 04 00 00 |..@...?....O....| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.| 00000200 00 00 00 62 6c 61 6e 6b 00 00 00 00 00 00 00 00 |...blank........| 00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000400 00 00 00 62 6c 61 6e 6b 00 00 00 00 00 00 00 00 |...blank........| 00000410 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| ... 00007c00 00 00 00 62 6c 61 6e 6b 00 00 00 00 00 00 00 00 |...blank........| 00007c10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00007e00 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 |................| * 00008000 19

  20. Area 2 File system layout $ hexdump -C -n 32768 -s 32768 4100_spool.001 00008000 00 00 00 02 00 00 00 00 00 04 a4 00 00 12 91 3c |...............<| 00008010 00 00 00 00 00 00 00 00 00 04 a3 ff 00 12 8c 91 |................| 00008020 00 00 00 00 00 00 00 00 11 11 22 22 00 00 00 1b |..........""....| 00008030 ca fe fe ca 00 00 80 00 1f ed fa ce 00 00 04 a7 |................| 00008040 00 00 00 10 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 00008050 e5 e5 e5 e5 e5 e5 e5 e5 3f ff ff ff ff ff ff ff |........?.......| 00008060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 00008180 ff 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00008190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00008200 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 |................| * 0000fe00 00 00 06 03 00 00 00 00 00 04 a4 00 00 12 91 3c |...............<| 0000fe10 00 00 00 01 e5 e5 e5 e5 00 04 9d fc 00 12 84 06 |................| 0000fe20 e5 e5 e5 e5 00 00 01 00 11 11 22 22 00 00 00 1b |..........""....| 0000fe30 ca fe fe ca 00 00 80 00 1f ed fa ce 00 00 04 a7 |................| 0000fe40 00 00 00 10 e5 e5 e5 e5 00 04 a2 03 00 00 00 00 |................| 0000fe50 ff ff e5 e5 e5 e5 e5 e5 03 ff ff ff ff ff ff ff |................| 0000fe60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 0000ff80 ff 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 0000ff90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 20 00010000

  21. Area 3 Inodes $ hexdump -C -n 512 -s 97792 4100_spool.001 00017e00 41 ff 00 0a 00 00 00 00 00 00 00 00 00 00 02 00 |A...............| 00017e10 00 00 0e ea 00 00 0e 4b 00 00 0e 4b 00 00 00 01 |.......K...K....| 00017e20 00 04 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00017e30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00017e40 00 00 00 00 00 00 00 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 00017e50 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00017e80 41 f8 00 02 00 00 00 00 00 00 00 00 00 00 04 00 |A...............| 00017e90 00 00 0e e4 00 00 00 20 00 00 00 20 00 00 00 01 |....... ... ....| 00017ea0 00 04 ab 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00017eb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00017ec0 00 00 00 00 00 00 00 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 00017ed0 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| $ hexdump -C -n 512 -s 284160 4100_spool.001 00045600 81 ff 00 01 00 00 00 01 00 06 00 00 00 05 6c 76 |..............lv| 00045610 00 00 0e 4c 00 00 0e 4d 00 00 0e 4d 00 00 00 0c |...L...M...M....| 00045620 00 0c e7 00 0c e8 00 0c e9 00 0c ea 00 0c eb 00 |................| 00045630 0c ec 00 0c ed 00 0c ee 00 0c ef 00 0c f0 00 0c |................| 00045640 f1 00 00 00 00 00 00 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 00045650 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 21

  22. Area 4 Unused inodes and endianess $ hexdump -C -n 1024 -s 295424 4100_spool.001 00048200 00 00 06 0a 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048210 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048280 00 00 06 0b 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048290 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048300 00 00 06 0c 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048310 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048380 00 00 06 0d 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048390 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048400 00 00 06 0e 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048410 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048480 00 00 06 0f 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048490 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048500 00 00 06 10 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048510 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048580 00 00 06 11 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048590 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 22

Recommend

2015-2017 (c) P.Pale: Computer Forensics 2015-10-17 File System Forensics A New York

2015-2017 (c) P.Pale: Computer Forensics 2015-10-17 File System Forensics A New York

2015-2017 (c) P.Pale: Computer Forensics 2015-10-17 File System Forensics A New York computer forensics firm found that 40% of the hard disk drives it recently purchased in bulk orders on eBay contained personal, private and sensitive

884 views • 70 slides
CSN11121/CSN11122 System Administration and Forensics File System 28/10/2011

CSN11121/CSN11122 System Administration and Forensics File System 28/10/2011

CSN11121/CSN11122 System Administration and Forensics File System 28/10/2011 r.ludwiniak@napier.ac.uk Lecture Objectives 1. Investigative Process Analysis Framework 2. File Systems FAT NTFS Required Reading G.H. Fellow,

705 views • 51 slides
DFIR FILE SYSTEM FORENSICS DEV DUA (@dev0x01) &gt;&gt; whois Dev.Dua # Star Wars fan, clearly.

DFIR FILE SYSTEM FORENSICS DEV DUA (@dev0x01) &gt;&gt; whois Dev.Dua # Star Wars fan, clearly.

DFIR FILE SYSTEM FORENSICS DEV DUA (@dev0x01) &gt;&gt; whois Dev.Dua # Star Wars fan, clearly. # M.Eng. Cybersecurity # JOATMON Full Stack Developer, Security Engineer, Scripting/Automation, Researcher # Twitter: dev0x01 # Web:

1.03k views • 43 slides
CSN08101 Digital Forensics Lecture 8: File Systems Lecture 8: File Systems Module Leader: Dr

CSN08101 Digital Forensics Lecture 8: File Systems Lecture 8: File Systems Module Leader: Dr

CSN08101 Digital Forensics Lecture 8: File Systems Lecture 8: File Systems Module Leader: Dr Gordon Russell Lecturers: Robert Ludwiniak Objectives Investigative Process Analysis Framework last week File Systems File

795 views • 50 slides
Digital forensics and malware Digital forensics According to Wikipedia, you could be looking

Digital forensics and malware Digital forensics According to Wikipedia, you could be looking

Digital forensics and malware Digital forensics According to Wikipedia, you could be looking for: attribution, alibis and statements, intent, evaluation of source, document authentication File carving ( e.g. , bifragment gap carving)

630 views • 13 slides
CSE 469: Computer and Network Forensics Topic 5: Image Forensics Dr. Mike Mabey | Spring 2019

CSE 469: Computer and Network Forensics Topic 5: Image Forensics Dr. Mike Mabey | Spring 2019

CSE 469: Computer and Network Forensics Topic 5: Image Forensics Dr. Mike Mabey | Spring 2019 CSE 469: Computer and Network Forensics Forensics for Graphics Files Types of graphics file formats Type of data compression How to locate

362 views • 25 slides
Chapter 12: File System Implementation File System Structure File System Implementation

Chapter 12: File System Implementation File System Structure File System Implementation

Chapter 12: File System Implementation File System Structure File System Implementation Directory Implementation Allocation Methods Free-Space Management Efficiency and Performance Recovery Log-Structured File Systems

492 views • 47 slides
CSE 469: Computer and Network Forensics Topic 4: File Systems Dr. Mike Mabey | Spring 2019 CSE

CSE 469: Computer and Network Forensics Topic 4: File Systems Dr. Mike Mabey | Spring 2019 CSE

CSE 469: Computer and Network Forensics Topic 4: File Systems Dr. Mike Mabey | Spring 2019 CSE 469: Computer and Network Forensics My Sources https://smile.amazon.com/Underst https://smile.amazon.com/System-

697 views • 46 slides
~FILE SYSTEM~ SUNU WIBIRAMA OUTLINE FILE SYSTEM ACCESS METHODS DIRECTORY STRUCTURE FILE

~FILE SYSTEM~ SUNU WIBIRAMA OUTLINE FILE SYSTEM ACCESS METHODS DIRECTORY STRUCTURE FILE

~FILE SYSTEM~ SUNU WIBIRAMA OUTLINE FILE SYSTEM ACCESS METHODS DIRECTORY STRUCTURE FILE SYSTEM MOUNTING PROTECTION EXTERNAL VIEW OF THE FILE MANAGER FILE MANAGEMENT FILE, IS A NAMED AND ORDERED COLLECTION OF INFORMATION COMPUTER SHOULD

341 views • 33 slides
File Systems Chapter 11, 13 OSPP What is a File? What is a Directory? Goals of File System

File Systems Chapter 11, 13 OSPP What is a File? What is a Directory? Goals of File System

File Systems Chapter 11, 13 OSPP What is a File? What is a Directory? Goals of File System Performance Controlled Sharing Convenience: naming Reliability File System Workload File sizes Are most files small or large?

996 views • 62 slides
Small-block Disk Forensics and Triage Outline Disk Structure. Triage. File Signatures.

Small-block Disk Forensics and Triage Outline Disk Structure. Triage. File Signatures.

Small-block Disk Forensics and Triage Outline Disk Structure. Triage. File Signatures. Discriminators. Contraband Identification. Sector-based Hashing. Conclusions. Author: Prof Bill Buchanan Small Block Disk Forensics and

768 views • 45 slides
CSE 120 File System Interface What the user/programmer sees File System Implementation

CSE 120 File System Interface What the user/programmer sees File System Implementation

Overview CSE 120 File System Interface What the user/programmer sees File System Implementation How it works Summer, 2006 Day 9 File Systems Instructor: Neil Rhodes 2 What is a File? Typical Filesystem Named collection of related

175 views • 5 slides
File System Implementation Summer 2016 Cornell University Today File allocation Unix

File System Implementation Summer 2016 Cornell University Today File allocation Unix

CS 4410 Operating Systems File System Implementation Summer 2016 Cornell University Today File allocation Unix file system Log-structured file system 2 File system: two design problems User interface: File, directory,

362 views • 21 slides
Distributed File Systems Distributed File Systems A distributed file system (DFS) is a

Distributed File Systems Distributed File Systems A distributed file system (DFS) is a

Distributed File Systems Distributed File Systems A distributed file system (DFS) is a distributed Definitions implementation of a classical time-sharing model of a file Distributed system - A number of loosely coupled system. machines

997 views • 8 slides
Windows File System Efficiency and Stability of a file system are contradicting requirements. How

Windows File System Efficiency and Stability of a file system are contradicting requirements. How

Unit OS8: File System 8.6. Quiz Windows Operating System Internals - by David A. Solomon and Mark E. Russinovich with Andreas Polze Windows File System Efficiency and Stability of a file system are contradicting requirements. How can the

279 views • 11 slides
Distributed Systems - III Open a file, check status on a file, close a file; Read data

Distributed Systems - III Open a file, check status on a file, close a file; Read data

CSE 421/521 - Operating Systems What does Distributed File System Provide? Fall 2011 Provide access to and manipulation of data stored at remote servers using file system interfaces Lecture - XXV What are the file system interfaces?

236 views • 5 slides
File System Thierry Sans (recap) File System Abstraction File system specifics of which disk

File System Thierry Sans (recap) File System Abstraction File system specifics of which disk

File System Thierry Sans (recap) File System Abstraction File system specifics of which disk class it is using It issues block read/write requests to the generic block layer Provide an abstraction Goals Implement an abstraction (files) for

389 views • 37 slides
FILE SYSTEM IMPLEMENTATION Sunu Wibirama Outline File-System Structure File-System

FILE SYSTEM IMPLEMENTATION Sunu Wibirama Outline File-System Structure File-System

FILE SYSTEM IMPLEMENTATION Sunu Wibirama Outline File-System Structure File-System Implementation Directory Implementation Allocation Methods Free-Space Management Discussion 11. Outline File-System Structure

516 views • 51 slides
Week 10: File Management What is a file? Elements of file management File

Week 10: File Management What is a file? Elements of file management File

CPSC 410 / 611 : Operating Systems Week 10: File Management What is a file? Elements of file management File organization Directories File allocation UNIX file system Reading: Silberschatz, Chapter 10, 11

498 views • 13 slides
CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic

CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic

CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic 20/10/2011 r.ludwiniak@napier.ac.uk Lecture Objectives 1. History and definition of Digital Forensics 2. Context for an investigation 3. An overview of

1.04k views • 65 slides
Speeding up file system checks in ext4 Theodore Ts'o Why File System Checks Are Necessary

Speeding up file system checks in ext4 Theodore Ts'o Why File System Checks Are Necessary

Speeding up file system checks in ext4 Theodore Ts'o Why File System Checks Are Necessary Software is not perfect Bugs in kernel (File system, VM, Device Driver code) Hardware is not perfect Disk errors Memory errors File

613 views • 24 slides
Chapter 11: File-System Interface File Concept Access Methods Directory Structure

Chapter 11: File-System Interface File Concept Access Methods Directory Structure

Chapter 11: File-System Interface File Concept Access Methods Directory Structure File System Mounting File Sharing Protection Operating System Concepts Silberschatz, Galvin and Gagne 2002 11.1 File Concept

387 views • 15 slides
File-System: Implementation Summer 2013 Cornell University 1 Today How is the file system

File-System: Implementation Summer 2013 Cornell University 1 Today How is the file system

CS 4410 Operating Systems File-System: Implementation Summer 2013 Cornell University 1 Today How is the file system implemented? Layered file system Directory implementation Allocation methods Free-space management 2

453 views • 18 slides
Distributed Storage Networks and Computer Forensics 6 File Systems Christian Schindelhauer

Distributed Storage Networks and Computer Forensics 6 File Systems Christian Schindelhauer

Distributed Storage Networks and Computer Forensics 6 File Systems Christian Schindelhauer University of Freiburg Technical Faculty Computer Networks and Telematics Winter Semester 2011/12 Montag, 14. November 11 Literature Storage

470 views • 15 slides

More recommend