2Hard Drive Partitioning Boot process starts in ROM.Eventually, loads master boot record from booting device.MBR located at well-known location.
3Hard Drive Partitioning (Windows Only) MBR located always in the first sector of booting device.Cylinder 0, Head 0, Sector 1
4MBR Structure First part bootstrap program. Is loaded into memory, then relocates itself in order to make room for another copy.Starting at offset 0x1be 16B partition tableLast two bytes of sector are 0x55 and 0xaa.
6Partition Table Entry Byte 0: active (0x80) or inactive (0x00) Bytes 1-3: Start of PartitionByte 4: Partition TypeBytes 5-7: End of PartitionBytes 8-12: LBA address of start sector relative to start of disk in little endianBytes 13-16: Number of sectors in the partition
7Partition Table Example DE FE 3F 04 3FByte 1: 00 = inactive (not bootable)Only one partitions on a windows system should be bootable.
8Partition Table Example DE FE 3F 04 3FBytes 1-3: Split up as| h7-h0 | c9 c8 s5-s0 | c7-c0 |In binary, we haveh7h6h5h4 h3h2h1h0 c9c8s5s4 s3s2s1s c7c6c5c4 c3c2c1c0So: H=1, C = 0, S = 0x1 = 1.
9Partition Table Example DE FE 3F 04 3FByte 4: Partition Type 0xDE.Look this one up in a table. It is a Dell PowerEdge Server utilities (FAT fs)0x0112b FAT Partition0x0416b FAT Partition0x05Extended Partition0x06BIGDOS FAT0x07NTFS
10Partition Table Example DE FE 3F 04 3FBytes 5-7: End of PartitionSplit up as | h7-h0 | c9 c8 s5-s0 | c7-c0 |So: h=0xE, c=0x04, s = 0x3f
11Partition Table Example DE FE 3F 04 3FBytes 8-12: LBA 3F in Little EndianThat is F is the real start LBAGo to Sector 63 and find indeed the FAT boot sector.
12Partition Table Example DE FE 3F 04 3FBytes 13-16: Number of Sectors in the partition (in Little Endian).Value is 0XTranslate into true value:0x = 80,262 sectors
13Partition Table Example We have a Dell partition of size 40MB. This partition is invisible to Windows and could be used to hide data.Dell uses this area to help with recovery from OS disasters.
14Master Boot RecordBy creating a partition and then editing the MBR I can create hidden partitions.The data on these hidden partitions is not visible from Windows.
15Master Boot RecordThe partitions do not have to fill up the disk completely, there can be unused sectors (which could contain hidden data.)
16Extended PartitionsOvercome the four partition limit.
17Extended Partitions Marked by a partition code of 0x05 or 0x0f. First sector of an extended partition contains a partition table with up to two entries.Extended partition is a container for secondary extended partition.
18Extended PartitionsFirst sector contains partition table, structured like MBREntries are 16B with the same structureFirst entry is for primary extended partition.Optional second entry is for secondary, extended partition.
19Extended PartitionsPrimary extended partition contains the secondary extended partition.
21Unassigned sectorsMany sectors on a disk are not assigned to a partition.Cannot be seen from OS.Good hiding place for a virus.
22GUID GUID Partition Table (GPT) Part of the Extensible Firmware Interface
23GUIDEFI (Extensible Firmware Interface) is Intel’s proposed replacement for the PC BIOSMorphed into UEFI (Unified …)Is used in some BIOS systems to overcome limitations of the MBR partition tableMBR uses 32 bits for storing LBA size informationGives a maximum of 2.2·1012 B
24GUID Partition Area Partition Table Backup Area Protective MBR GPT Header
25GUID Supported by most unix systems for RW and boot Only supported on Windows-32 for RW since Windows Server 2003 SP1Supported by Windows 64 for RW and for boot with UEFI
26GUID Partition Table At LBA 0: traditional MBR But protective of following GPT tableSingle partition of type 0xEE spans whole diskIf the OS boots through BIOS, the first sector holds bootloader code
27GUID Partition Table LBA 1: Partition Table Header / GPT Header 0-7: Signature Value “EFI PART”8-11: Version12-15: Size of header16-19: Checksum24-31: LBA of current GPT header32-39: LBA of alternative GPT header40-47: Start of partition area48-55: LBA of end of partition area56-71: Disk GUID72-79: Start of partition table80:83: Number of entries in partition table84-87: Size of entries in partition table88-91: CRC of partition table
28GUID Partition Table GPT partition table entry 0-15: Partition type GUID16-31: Unique partition GUID32-39: Start (LBA) of partition40-47: End of partition48-55: Partition attributes56-127: Partition name (Unicode)
29Apple Partitions File System Partition 1 File System Partition 2 Partition Map
30Apple Partitions Partition map structure located at beginning of disk Firmware contains boot codeEach entry (512B) describes starting sector, size, type, and gives volume nameFirst entry describes partition map itself
31Other Partition Schemes BSD partitionCan be located inside a DOS partitionSun Solaris Slices
33Categories File System Category Content Category Metadata Category General file system information:Sizes, performance tuningContent CategoryActual content of a fileMetadata CategoryData that describes a fileLocation, Size, Times & Dates,
34Categories File name category Application category Used for human-system interfaceApplication categoryData for special functions such asQuota, file system journals
35Essential & Non-Essential Data Essential data are needed for the functioning of the file systemAre trustworthyNon-Essential data:Example: Access timesTrustworthiness depends on OSExample: Create time tunneling in WindowsIf a file is deleted and a new file created within 15 sec, then the new file obtains the create time of the original file
36Wiping Techniques Most wiping is for content only “Secure deletes” wipe contentMost wiping software uses OS interfaceWhich can optimize away wiping writes
43BPBThe data allows us to draw a picture of the partition:
44FAT File System File Allocation Table (FAT) Three variants Resides at the beginning of the volumeTwo copies of the tableThree variantsFAT12FAT16FAT32Allocation in clusters.Clusters number is a power of two < 216
45FAT File System Root directory File Allocation Table (FAT) Maintains file names, location, characteristics, …File Allocation Table (FAT)Allows files longer than a single cluster
46FAT Principle Root directory gives first cluster FAT gives subsequent ones in a simple tableUse FFFF to mark end of file.
47Cluster SizeLarge clusters waste disk space because only a single file can live in a cluster.Small clusters make it hard to allocate clusters to files contiguously and lead to large FAT.
48FAT Table To save space, limit size of entry. That limits total number of clusters.FAT 12: 12 bit FAT entriesFAT 16: 16 bit FAT entriesFAT 32: 32 bit FAT entries
49FAT Table Entry FAT 12 FAT 16 Meaning 000 0000 available not usedFF0 FFF0-FFF6 reservedFF8-FFF FFF7 bad cluster0xhhh 0xhhhh next cluster used by file
50Root Directory A fixed length file (in FAT16, FAT32) Entries are 32B long.Subdirectories are files of same format.
51Root Directory Entries OffsetLengthMeaning0x008BFile Name0x083BExtension0x0b1BFile Attribute0x0c10BReserved:(Create time, date, access date in FAT 32)0x162BTime of last change0x18Date of last change0x1aFirst cluster0x1c4BFile size.
52Root Directory Example This is a deleted file ?wrd0700.tmpSize isFirst cluster is 00 4EMultiply with the cluster size to find the sector.
53Root Directory Entries File Name: First character means0x00: Entry never used, end of directory0xe5: File deleted0x2e: Directory
55Root Directory Entries Hidden file: not displayed.System file: special treatment for deletion.Volume: Name of the volume if this bit is set. Rest of the name is in the reserved portion.Subdirectory: File is not a file but a directory (looks like the root directory).
57FATDeleted files / directories with entries intact can be easily reconstructed.If entry is overwritten, then pieces might be found in the FAT.Large storage devices make it impossible to do it without a tool.
58FAT 32 Root Directory Uses 4B to store the files first cluster. Adds access date and modification date and timeModification, Access, Creation (MAC) give important hints during an investigation
59FAT 32 Root Directory 0x00 8B File Name, padded with zeroes 0x08 3B 3 byte extension0x0b1BFile attribute0x0cReserved0x0dMillisecond stamp at file creation time.0x0e2BFile creation time.0x10File creation date.0x12File access date.0x14High word of file’s first cluster0x16Last write time.0x18Last write date.0x1aLow word of the file’s first cluster0x1c4BFile size in bytes.
60Long File NamesSupport for long file names needs to be backwards compatible.Long file names should be stored next to the corresponding short entry.Disk utilities should not misdiagnose long file name entries as faultyUnicode support
61Long File Name Entries Encode long file name in several long entries Precede immediately short entryHave entry order number.Last entry order number is or’d with 0x40 to mark it.
62Long File Name Support Create a 8B short file name from long one. Calculate checksum from short name and store in all long records
63Long File Name Entries 0x00 1B Entry order number. 0x01 10B Characters 1-5 of name entry.0x0bFile Attribute. MUST be 0F.0x0cShould be 00.0x0dChecksum of short file name.0x0e12BCharacters 6-11 of name entry.0x1a2BMUST be to be compatible.0x1c4cCharacters of name entry.
64Long File Name EntriesEntry Order NumberAttribute
65Subdirectories Are files with the same structure as root directory. Contain two special entries.. Has name “..” and refers to parent directory. Has name “.” and refers to itself.
87Recovering FilesThis was easy because we just followed directory entries.WinHex actually calculates a lot of the values that we distilled by hand.Reconstructs directory entries on its own.But has no generic file previewer
88Recovering Files If directory entry is overwritten: Look for sectors in slack space.Look for files that have not been overwritten.Try to splice pieces of the file together from the FAT.Use pattern recognition software to guess file type.Result is frequently useful.
89Recovering Files Text files: Search for Words in the Duplicate. Learn how word processors store files.Interesting finds, especially in old MS Word formats.
91NTFS Concepts Everything is a file Master File Table (MFT) is the heart of NTFSEach file and directory has an (at least) 1KB entry in the MFTMFTEntryHeaderAttributeAttributeAttributeUnusedSpace
92NTFS ConceptsFirst entry in the MFT is called $MFT and describes itselfStarting address of MFT is in the boot sectorEverything else is in the $MFT entryAllocation is in clustersSize of clusters is defined in the boot sector
93MFT entry MFT Entry Size is given in the boot sector But in all windows systems equal to 1KBFirst 42B contain 12 fieldsRest is unstructured and used for attributesFirst entry is the signature:FILE for a valid entryBAAD for an erroneous entryFlag field ($BITMAP) tells whether entry is used and a directory
94MFT EntryA file with too many attributes can take up more than one entryFirst entry is the base file recordRest contains the base file record address in their contents
95MFT Entry Addresses: 48b address for each entry File Number Maximum address is size of MFT / size of entry16b sequence numberIncremented whenever the entry is reused16b sequence number followed by file number gives 64 b file-reference address
96MFT Entry (File System) Metadata Files Store system’s administrative dataFirst 16 entries reserved for them$MFT: Entry for MFT$MFTMirr: Backup MFT$LogFile: Journal for metadata transactions$Volume: Volume information$AttrDef: Definitions used for attributes-: Root directory$Bitmap: Allocation status of clusters$Boot: Boot sector and boot code$BadClus: Clusters with bad sectors$Secure: Info on security and access control$Upcase: Uppercase versions of Unicode characters$Extend: Directory containing files for optional extensions
98MFT Entry Attribute Headers Identifies type of attribute, size, name Flags to tell whether value is compressed or encrypted
99MFT Entry Attributes Can be “resident” Can be “non-resident” Inside the entryCan be “non-resident”Stored in external clustersHeader will give the cluster addressesStored in Cluster RunsSets of consecutive clustersVirtual Cluster Numbers start with end of MFTLogical Cluster Numbers correspond to LBA
100MFT EntrySince attributes have a 16b identifier, there can be 216 of themIf there is an overflow, can use additional MFT entriesMain MFT entry becomes the base entryOthers have the base entry’s address in their MFT entry field
101MFT Entry Sparse attributes Non-resident $DATA can be flagged as a sparse attributeZero clusters are replaced with zero runs
102MFT Entry Compressed attributes Non-resident $DATA can be compressed by the file systemAttribute header flag identifies compression$STANDARD_INFORMATION and $FILE_NAME attributes also give that information
103MFT Entry Encrypted attributes Windows allows $DATA to be encrypted Only the contents are encrypted, not the attribute headerA directory chosen to be encrypted only has the files encrypted$LOGGED_UTILITY_STREAM attribute is created for the file, which contains the keyAlgorithm is DESXEach MFT entry has its own key, the file encryption key (FEK)File encryption key is stored in encrypted formFor each user, FEK is encrypted with public key in the data decryption fields of $LOGGED_UTILITY_STREAM
104NTFS Analysis $MFT file contains the Master File Table $MFTMIRR is its backup copyWith entries for, at least$MFT, $MFTMIRR, $LogFile, $VolumeRecovery tool can determine MFT layout and size, use the $LogFile to recover file system, and obtain version and status from $Volume
110NTSF Boot Sector Many fields are not important, but: 0x0B, Bytes per sector.0x0D Sectors per Cluster0x15 Media descriptor. F8: HD; F0: HD Floppy0x28 Total sectors.0x30 Logical cluster number for the MFT0x38 Logical cluster number copy of the MFT0x Clusters per MFT Record.0x48 Volume serial
111NTFS Boot SectorWinHex allows access to an interpreted NTFS Boot Sector.Use the Access Tab.
119MFT Record Structure Entries are 1KB each Entries contain File AttributesLocation Data
120MFT RecordsSmall Files (<900B) are contained completely in the MFT entry.
121MFT Records Folders contain index data. Small folders reside within the MFT recordLarger folders have an index structure to other data blocks. They use a B-tree structure.
122MFT Record Each MFT record is addressed by a 48 bit MFT entry value. First entry has address 0.Each MFT entry has a 16 bit sequence number that is incremented when the entry is allocated.MFT entry value and sequence number combined yield 64b file reference address.
123MFT RecordNTFS uses the file reference address to refer to MTF entries.When the system crashes during allocation, then the sequence number describes whether the MTF entry belonged to the previous file or to the current one.
124MFT Record MFT entry attributes are loosely defined. Each attribute is preceded by the attribute header.The attribute header identifiesType of attribute.Size.Name.
125MFT Record StructureThe attribute header gives basic information about the attribute.A resident attribute is stored in the MFT entry.A non-resident entry is stored in a cluster outside the MFT.
126MFT Record Structure Resident attributes are stored in MFT record. Non-resident attributes are stored in cluster runs.Cluster run consists of consecutive clusters and are identified by starting cluster and run length.NTFS distinguishes between Virtual Cluster Numbers and Logical Cluster Numbers.LCN * (#sectors in cluster) = sector numberLCN 0 is first cluster in the volume (boot sector).VCN 0 refers to the first cluster in a cluster run.
127MFT Record StructureMFT entry header has a fixed structure
128MFT Record Structure 0x00 - 0x03: Magic Number: "FILE" 0x04-0x05: Offset to the update sequence.0x06-0x07: Number of entries in fixup array0x08-0x0f: $LogFile Sequence Number (LSN)0x10-0x11: Sequence number0x12 - 0x13: Hard link count0x14-0x15: Offset to first attribute
129MFT Record Structure0x16 - 0x17: Flags: 0x01: record in use, 0x02 directory.0x18-0x1b: Used size of MFT entry0x1c-0x1f: Allocated size of MFT entry.0x20-0x27: File reference to the base FILE record0x28-0x29: Next attribute ID0x2a-0x2b: (XP) Align to 4B boundary0x2c-ox2f: (XP) Number of this MFT record0x30-0x100: Attributes and fixup value
130MFT Record StructureEXAMPLE 1:A directory entry
131MFT RecordMFT records start with “FILE”. A bad cluster would start with “BAAD”
132MFT Record Bytes 4-5: Offset to update sequence. Bytes 6-7: Number of entries in fixup arrayBytes 8-f: Log file sequence numberBytes 0x10-0x11: Sequence number: 59 00
133MFT Record Bytes 0x12-0x13: 2 – hard link count Bytes 0x14-0x15: Offset to first attribute: 0x 38Bytes 0x16-0x17: Flags: In use and contains a directory 0x 0001 | 0x 0002
134MFT RecordBytes 0x14 – 0x15: First attribute starts at 0x 0x 00 38
135MFT List of possible attributes Defined in $AttrDef entry of MFT, but default is:0x10 STANDARD_INFORMATION0x20$ATTRIBUTE_LIST0x30$FILE_NAME0X40 (NT) $VOLUME_VERSION (2K) $OBJECT_ID0x50 $SECURITY_DESCRIPTOR0x60$VOLUME_NAME0x70 $VOLUME_INFORMATION0x80$DATA0x90$INDEX_ROOT0xA0$INDEX_ALLOCATION0xB0$BITMAP0xC0 (NT) $SYMBOLIC_LINK, (2K) $REPARSE_POINT0xD0$EA_INFORMATION0xE0$EA0xF0NT$PROPERTY_SET0x100 (2K) $LOGGED_UTILITY_STREAM
136MFT Attribute Layout Attributes can be resident or non-resident. Beginning is always the same:0x00 Attribute Type Identifier0x04 Length of Attribute0x08 non-resident flag0x09 length of name0x0a offset to name0x0c flags
137MFT Attribute Example Attribute is of type 00 00 00 10. Standard InformationAttribute is 0x bytes long.Attribute is resident (0x00)Contents are 0x bytes long and start at offset 0x
138Standard Info Attribute Layout MFT Attribute ExampleStandard Info Attribute Layout0x008File Creation Time0x08File Alteration Time0x10MFT Change0x18File Read Time0x204DOS File Permissions0x24Maximum number of versions0x28Version number0x2CClass ID0x302KOwner ID
139MFT Attribute ExampleThis allows us to extract the file access times just as for DOS.Time values are in 100 nanoseconds since January 1, 1601 UTC.
140MFT Attribute ExampleSecond entry has attribute number $FILE_NAME attributeTotal attribute length is 70 B.Contents start at offset 18B
141MFT Attribute ExampleThe content layout for the $FILE_NAME attribute is:0x00 File reference to parent directory0x08 File creation time0x10 File modification time0x20 File access time0x28 Allocated size of file0x30 Real size of file0x38 Flags0x40 File name length in unicode characters0x42 File name in unicode
142MFT Attribute ExampleObviously, this is a short file name.
143MFT Attribute ExampleThird attribute is also a file name, but this time the complete entry
153Unix File System Increasingly important LinuxMacOS XBewildering variety on a laptopLinux versionsFree BSDOpen BSDMac
154Unix File Systems Almost everything is a file. File has properties such asFile type and access permissions.Link count.Ownership & group membership.Date and time of last modification.File name.
155Unix File System Owners can change many of these data Including modification time.
156Unix File SystemBased on Inodes.More flexible than tables.
157Inodesi_mode (directory IFDIR, block special file (IFBLK), character special file (IFCHR), or regular file (IFREG)i_nlinki_uid (user id)i_gid (group id)i_size (file size in bytes)i_addr (an array that holds addresses of blocks)i_mtime (modification time & date)i_atime (access time & date)
163Unix File Systems First versions of Unix had a single file system. Unix System V Release 3.0 introduced File System Switch architecture.No longer a tight coupling between kernel and file system.
164Unix File Systems SunOS elaborated on this idea. Clear split between file system-dependent and file system-independent kernel.Intermediary layer is the VFS / VOP / veneer layer.Allows disk file systems such as 4.2 BSD FFS, MS-DOS, NFS, RFS.
165Unix File Systems Disk Layout not uniform. Ext2 (Linux) file system layout.
166Journaling File Systems File systems use caching in order to speed up operations.An unclean dismount can leave the file system in an unclean state.Journaling file system can keep a log, so that they can simply replay the log in order to bring the file system into a consistent state.
167Journaling File Systems Log can containOnly records of changes to metadata.Records of changes to metadata and client data.New values of blocks.Research Effort.Not successfully implemented.
168Journaling File Systems ext3 (adds journal to ext2) for LinuxJFSReiserFSXFS…
169Journaling File Systems Interesting opportunity for forensic investigation.Unfortunately, log entries get purged if too old.
172EXT Details Ext superblock: Located 1024 B from start of the file system.Backups of superblock are usually stored in the first block of each block group.Contains basic information:Block sizeTotal number of blocksNumber of reserved blocks
173EXT Details: EXT SuperBlock ByteDescription0-3BNumber of inodes in file system4-7BNumber of blocks in file system8-11BNumber of blocks reserved to prevent file system from filling up12-15BNumber of unallocated blocks.16-19BNumber of unallocated inodes.20-23BBlock where block group 0 starts24-27BBlock size. (Saved as the number of places to shift 1,024 to the left).28-31BFragment size. (Saved as the number of places to shift 1,024 to the left).32-35BNumber of blocks in each group.36-39BNumber of fragments in each block group40-43BNumber of inodes in each block group.44-47BLast mount time.48-51BLast written time.52-53BCurrent mount time.54-55BMaximum mount count
174EXT Details: EXT SuperBlock ByteDescription56-57BSignature 0xef5358-59BFile system state60-61BError handling method62-63BMinor Version64-67BLast consistency check time.68-71BInterval between forced consistency checks72-75BCreator OS76-79BMajor version80-81BUID that can use reserved blocks.82-83BGID that can use reserved blocks.84-87BFirst non-reserved inode in file system88-89BSize of each inode structure90-91BBlock group that this superblock is part of (if this is the backup copy)92-95BCompatibility feature flags96-99BIncompatbile feature flags
175EXT Details: EXT SuperBlock ByteDescriptionRead only feature flagsFile system IDVolume namePath were last mounted onAlgorithm usage bitmap204Number of blocks to preallocate for files.205Number of blocks to preallocate for directoriesJournal IDJournal InodeJournal deviceHead of orphan inode listUnused
176EXT Details Group Descriptor Table In the block following superblock Describes all block groups in the system
177EXT Details Group Descriptor Table Entries 0-3 starting block address of block bitmap4-7 starting block address of inode bitmap8-11 starting block address of inode table12-13 number of unallocated blocks in group14-15 number of unallocated inodes in group16-17 number of directories in group
178EXT DetailsTotal number of blocks includes Reserved area and all groups.Blocks per group determines size of group.
179EXT Details Block Group Descriptor Table Located in block following the superblockBasic layout of a block group:Block bitmap takes exactly one block.Inode bitmap manages allocation status of inodes.
180EXT DetailsNumber of blocks = bits in bitmap = bits in a block (namely the bitmap block).Size of block determines number of blocks in a block group!Inode bitmap starting address contained in block descriptor table.Size of Inode bitmap given by #inodes per group divided by 8.Block group descriptor table gives starting block for inode table.Size of inode table = 128B * number of inodes.
181EXT DetailsBoot CodeIf exists, will be in the 1024B before the superblock.Many Linux systems have a boot loader in the MBR.In this case, there will be no additional boot code.
182EXT Details Data stored in blocks. Typical block sizes are 1,024B; 2048B; or 4096BAllocation status of a block determined by the group’s block bitmap
183EXT Details Analyzing content: Locate any blockRead its contentsDetermine its allocation statusFirst block starts in the first sector of the file system. Block size is given by superblock.
184EXT Details Determining allocation status: Determine the block group to which the block belongs.Locate the groups entry in the group descriptor table to find out where the block bitmap is stored.Process the block bitmap to find out whether this block is allocated or not.
185EXT Details To find all unallocated blocks: Systematically go through the block bitmap and look for 0 bit entries.Status of reserved sectors at the beginning is less clear since there are no bitmap entries for them.
186EXT Details Metadata is stored in the inode data structure. All inodes have the same size specified in the superblock.Inodes have addresses starting with 1.Inodes in each group are in a table with address given by the group descriptor.group = (inode – 1) / INODES_PER_GROUP
187EXT Details Inodes 1 – 10 are typically reserved. Superblock has the value of the first non-reserved inode.Inode 1 keeps track of bad blocks.Inode 2 contains the root directoryJournal uses Inode 8First user file in Inode 11, typically for lost+found
188EXT DetailsInode can store the address of the first 12 data blocks of a file.For larger files, we use double indirect and triple indirect block pointers
189EXT Details Allocation Algorithms Block group: Non-directories are allocated in the same block group as parent directory, if possible.Directory entries are put into underutilized groups.Contents of allocated inode are cleared and MAC times set to the current system time.Deleted files have their inode link value decremented.If the link value is zero, then it is unallocated.If a process still has the file open, it becomes an orphan file and is linked to the superblock.
190EXT Details Inode Structure 0-1 File Mode (type and permissions) 2-3 Lower 16 bits of user ID4-7 Lower 32 bits of size in bytes8-11 Access Time12-15 Change Time16-19 Modification Time20-23 Deletion Time
191EXT Details Inode Structure 24-25 Lower 16 bits of group ID 26-27 Link count28-31 Sector count32-35 Flags36-39 Unused40 – direct block pointerssingle indirect block pointerdouble indirect block pointer
192EXT Details Inode Structure 96-99 1 indirect block pointer 100 – 103 Generation number (NFS)104 – 107 Extended attribute block108 – 111 Upper 32 bits of size / Directory ACL112 – 115 Block address of fragment116 Fragment index in block
193EXT Details Inode Structure 117 Fragment Size 118 – 119 Unused 120 – 121 Upper 16 bits of user ID122 – 123 Upper 16 bits of group ID124 – 127 Ununsed
194EXT Details Inode Structure Permission flags of the file mode field 0x001 Other – execute permission0x002 Other – write permission0x004 Other – read permission0x008 Group – execute permission0x010 Group – write permission0x020 Group – read permission0x040 User – execute permission0x080 User – write permission0x100 User – read permission
195EXT Details Inode Structure Flags for bits 9 – 11 of the file mode field0x200 Sticky bit (save text image)0x400 Set Group ID0x800 Set User ID
196EXT Details Inode Structure File mode field These are values not flags 0x1000 FIFO0x2000 Character device0x4000 Directory0x6000 Block device0x8000 Regular file0xA000 Symbolic link0xC000 Unix socket
197EXT Details Time Values Are stored as seconds since January 1, 1970, Universal Standard TimeGet ready for the Year 2038 problem.
198EXT Details Linux updates (in general) A-time, when the content of file / directory is read.For a file:If a process reads the file.When the file is copied.When the file is moved to a new volume.But not if the file is moved within a volume.For a directoryWhen a directory listing is done.When a file or subdirectory is opened.
199EXT Details Linux updates (in general) M-time, when the content of file / directory is modified.For a file:If file contents change.For a directoryWhen a file is created or deleted inside the directory.When a file is copied, the M-time is not changed.However, when a file is copied to a network drive, the network server might consider it a new file and reset the M-time to the current time.
200EXT Details Linux updates (in general) C-time corresponds to the last inode change.When file / directory is created.When permissions change.When contents change.D-time is set only if a file is deleted.When a file is created, then D-time is set to 0.
201EXT Details Unallocated inodes contain temporary data. M-, C-, D-time values might show when the file was deleted.Users can change A- and M-time with the touch command.
202EXT DetailsLinux fills slack space (unused bytes of block) with zeroes.Data from deleted files will only exist in unallocated blocks.File size and allocated blocks will probably be wiped from unallocated inode entries.
203EXT Details Linux file hiding technique: Have a process open a file for reading or writing.Delete the file name.Link count for the inode is zero, but inode is not unallocated.The file system should add the orphan inode to a list in the superblock.
204EXT Details Directory Structure A directory entry consists of A variable length name.The inode number with the metadata of the entry.The original byte allocation is as follows:0-3 Inode value4-5 Length of entry6-7 Length of name8- Name in ASCII
205EXT Details Directory Structure The improved byte allocation is as follows:0-3 Inode value4-5 Length of entry6 Length of name (up to 255 now)7 File type0 unknown1 regular file2 directory3 character device4 block device5 FIFO6 Unix Socket7 Symbolic link8- Name in ASCII
206EXT DetailsThe record entry length allows the file system to find the next entry in a directory.If a directory entry is deleted, then the previous entries length is increased.
207EXT DetailsWhen FS is created, a Linux user can decide to use hash trees instead.Directory entries are no longer in an unsorted list.A directory using a hash tree contains multiple blocks, the nodes in the tree.First block contains the “.” and “..” directory entries.
208EXT Details Links Hard link: an additional file/directory name. Implemented by another directory entry pointing to the same inode.Link count in inode is incremented.Directory link count is 2 + number of subdirectoriesFile system cannot distinguish between the first and the second name of file.
209EXT Details Links Soft link: an additional file/directory name. Implemented by a directory entry pointing to another inode.Inode points to a file, that contains the path to the original file.
210EXT Details Mount Point Example FS1 has directory /dir1. If FS2 is mounted on /dir1 and a user changed into /dir1, then only FS2 is shown.
211EXT DetailsEXT hiding technique uses a directory (containing the files to be hidden) as a mount point.Forensics tools tend to not give mount points.Consequentially, this hiding technique falls flat for forensics tools.
212EXT3 EXT3 journal located at inode 8 (typically) Journal records transactionsBlock updates about to occur.Log of update after the fact.Two modes:Only metadata blocks are journaled.Metadata and data blocks are journaled.
213EXT DetailsExt3 Journal gives additional information about recent events.
216Timestamp analysis Central to intrusion and criminal investigations Interest is around time of incidentTimestamps are the most important mean to order events (e.g. in the file system)But are attacked by “anti-forensic tools”Resetting clock can be used for framingNot in a big organization with time servers
217Sequence Number Causality Many digital systems use sequence numbersCan be strictly increasingCan wrap aroundExample: NTFSJournal file transactions are labeled with a Logical Sequence NumberFunctionality depends on LSN strictly increasingJournal file has limited sizeEntries are quickly overwrittenBut: NTFS stores LSN in the file metadataSince LSN is strictly increasing, this allows us to order chronologically eventsIndependent of time stamps
218Allocation Sequence Causality First-fit allocation stores new item in first available storage locationData items can be deleted and space becomes reusableOverwritten data is irretrievableSometimes: Use of generation markersGeneration marker is increased with each reuseNTFS: MFT entry numbers
219Allocation Sequence Causality Can be used to generate temporal sequence between eventsWillassen: Finding Evidence of Antedating in Digital Investigations, ARES 2008
220Allocation Sequence Causality NTFS MFT uses first-fit storage with generation markers (entry-sequence number)Implement a checkerIs (recovered) time consistent with markers
221Log Entries Systems maintains many logs Events are added in logs at the endIf logs can be trusted:Order of two events in the log give order of events in timeLogs can have time stamps on entriesTime stamps need to be consistent with entries
222Probable Orderings Inode numbers are usually allocated in series Allows using inode numbers to find file creation events at the same time