Presentation is loading. Please wait.

Presentation is loading. Please wait.

Files & Partitions BACS 371 Computer Forensics. Data Hierarchy Computer Hard Disk Drive Partition File Physical File Logical File Cluster Sector Word.

Similar presentations


Presentation on theme: "Files & Partitions BACS 371 Computer Forensics. Data Hierarchy Computer Hard Disk Drive Partition File Physical File Logical File Cluster Sector Word."— Presentation transcript:

1 Files & Partitions BACS 371 Computer Forensics

2 Data Hierarchy Computer Hard Disk Drive Partition File Physical File Logical File Cluster Sector Word Byte Bit

3 File  Collection of Information written to a disk  Generally created in an application-specific format  Occupies a fixed number of clusters  Each file’s cluster has a pointer to the next cluster in the file  The final cluster contains the End of File (EOF) marker

4 Files  Logical File Size  Exact size of contents of file in bytes  Physical File Size  Amount of space a file occupies on disc in bytes  File Slack  Unused space between logical end of file and physical end of a cluster  Two types: RAM slack and Disk Slack Physical File Size

5 File Slack  What does File Slack Contain?  Who knows??!!  Old data that was deleted but not overwritten yet  May contain remnants of older files, or other evidence including Passwords Old directory structures Miscellaneous information

6 File Slack Example Hello World! Has 12 Characters in the file But occupies 4096 bytes on the disk!

7 File Slack Example

8 File Contents: “Hello world!” 12 bytes 2 nd Sector 3 rd Sector RAM Slack: 512 bytes – 12 bytes = 500 bytes Disk Slack: 4096 Bytes – 512 Bytes = 3584 Bytes Assumptions: Sector Size = 512 Bytes Cluster Size = 4KB = 8 Sectors

9 File Slack Example  RAM Slack  The file has only 12 characters, but must write a minimum 512-byte block to the disk – the other 500 characters are whatever happen to be in RAM at the time  Disk Slack  The file system must always write in multiples of clusters (4096 bytes in this case.) The other 3584 bytes (7 sectors) are filled with whatever used to be in the clusters before they were marked for deletion.

10 RAM Slack  Unused space at the end of a sector  Contains information adjacent to the stored information from Main Memory (RAM)

11 Partitions

12 Partition Layout net/images/prodtechnol/winxppro/reskit/ch28/f28zs 07_big.jpg

13 Partition Table 4 Entries First Entry Starts at offset 0x01BE Master Boot Record (MBR) MBR “Signature” 0x55AA Executable Code Machine Language Code Processor Specific Decodes Partition Table 446 bytes long

14 Partition Table  A partition is a logical drive or volume  Describes every logical volume on disk  Master Partition Table  Contains descriptions of partitions on disk  Room to describe 4 primary partitions  One partition is marked as active and is used for booting  Partition Gap  Unused space between partitions

15 Partition Boot Sector  0x00-0x02Jump Instruction (3 bytes)  0x03-0x0AOEM ID (8 Bytes)  0x0B-0x53BIOS Parameter Block (BPB) (includes all below plus additional fields)  0x0BBytes Per Sector2 Bytes  0x0DSectors Per Cluster1 Byte  0x15Media Descriptor1 Byte  0x18Sectors Per Track2 Bytes  0x1ANumber of Heads2 Bytes  0x1CHidden Sectors4 Bytes  0x20Total Sectors4 Bytes  0x3E-0x1FFBootstrap Code (448 Bytes)  Ends with 55 AA NOTE: Offsets are from start of Partition, not start of Drive!

16 BIOS Parameter Block Executable Code Machine Language Code Processor Specific Decodes BPB Searches for OS PBR “Signature” 0x55AA Partition Boot Record (PBR)

17 Partition Boot Sector AKA File System Boot Sector  The first physical sector in a logical volume  C 0, H 1, S 1 for first partition  Contains  Code  File System Specification Information

18 Partition Boot Sector Decoded

19 Extended Partition Layout /1033/technet/images/prodtechnol/winx ppro/reskit/ch28/f28zs07_big.jpg

20 Computer Boot Process  Power-on Signal  CPU Reset  ROM BIOS/bootstrap  POST (P ower O n S elf T est )  Memory test  Support circuitry  Major Peripherals (ROM)  Boot  Drive A:  CDROM  Hard Drive  Master Boot Record  (Volume) Boot Record

21 Computer Boot Details 1. Power Switch Activated 2. Power Supply performs self-test (PowerGood signal to Motherboard) 3. Microprocessor executes BIOS code starting at 0xFFFF0000 – tests hardware 4. Power On Self Test (POST) executed – checks CPU, ROM, RAM, support circuitry, peripherals 5. BIOS searches for MBR at C 0, H 0, S1 on default boot drive 6. MBR loaded into memory and tested/executed 7. MBR code locates first bootable partition 8. Partition Boot Record is loaded into memory and tested/executed 9. Operating System is loaded based upon command in PBR NTLDR IOSYS 10. On NTFS volumes NTLDR loads the $MFT; The NT volume is mounted 11. NTDETECT.COM detects computerID, bus adapter, video adapter, … 12. NTLDR loads NTOSKRNL.EXE (kernel) and HAL.DLL (hardware abstraction layer) 13. The kernel initiates the OS


Download ppt "Files & Partitions BACS 371 Computer Forensics. Data Hierarchy Computer Hard Disk Drive Partition File Physical File Logical File Cluster Sector Word."

Similar presentations


Ads by Google