2. FILE SYSTEM ANALYSIS Dr Fudong Li
School of Computing, Electronics & Mathematics
Plymouth University
United Kingdom

3. Introduction to File Systems New Technology File System (NTFS)
Session Content
Introduction to File Systems
New Technology File System (NTFS)
Conclusions

4. Introduction to File Systems

5. File Systems
A file system is the underlying structure that a computer uses to organise data on a hard disk.
Provides data storage and retrieval
Associates names with data files
Organises files into parent directories
Stores files attributes (metadata), such as Modify, Access, Creation (MAC) times, size, permissions
Maintains lists of unallocated data unit
Examples: FAT32, NTFS, HFS+, ext2…
Different file systems have various features (e.g. maximum file size, security controls)

6. File System Behaviours
File operations: create, delete, open, close, read, write, rename, and change attributes
File (directories) attributes
Name, content, size, file type, permissions, MAC times, author information, encryption, EXIF…
The relationship between file systems and digital forensics
File content: most reliable evidence
Name: provides indication on what the file is about
MAC times: timeline analysis
File operations: slack space analysis, data carving

7. File Creation
When a new file is created or an existing file is made larger, the Operating System searches for an unallocated data unit and allocates it to the file.
A data unit (data block): sectors and clusters
The state of a data unit: allocated or unallocated
Allocation strategies: first available, next available, or best fit.

8. Data Unit
A sector is the smallest addressable storage unit on the hard disk and typically 512 bytes
The optimal method of storing a file is in a contiguous series
A 600-byte file requires 2 sectors.
A cluster is the smallest unit at the operating system level and can consist of one or more consecutive sectors.
The number of sectors in one cluster is always an exponent of 2. hence, 1, 2, 4, 8…
Is used for protecting the stored data from being over-written.

9. Bitmap
A bitmap is a data structure that has a bit for each cluster on the hard disc.
1: the cluster is allocated
0: the cluster is unallocated
Pros: Simple, Fast allocation check, Fast deletion, Fix cost, Low storage overhead (0.003% for NTFS)
Cons: Wasteful on larger disks, Poor Scalability, Disk fragmentation

10. Content Allocation Strategies
A first available strategy searches for an available cluster starting with the first cluster in the file system.
A similar strategy is next available, which starts its search with the cluster that was most recently allocated instead of at the beginning.
A Best fit strategy, which searches for consecutive clusters that fit the needed amount of data.

11. Content Allocation Scenario
Creating a file: size: 2 clusters; last allocated cluster ID is 2.
What are the cluster IDs for the file content when using first available, next available and best fit?
First available: Clusters 1 and 3
Next available: Clusters 3 and 5
Best fit: Clusters 5 and 6
Causing file fragmentation

12. Content Allocation Scenario
Creating a file: size: 2 clusters; last allocated cluster ID is 2.

13. Slack Space (1)
Slack space occurs when the size of a file is not a multiple of a cluster size.
RAM slack is the area from the end of the file to the end of that sector.
Under DOS and early versions of Windows the data used for this comes directly from RAM
More typically this is filled with zeros
File slack is the area from the end of RAM Slack to the end of the cluster – it is typically not changed, leaving the prior contents still present
Clusters: fixed length blocks of data (1-128 sectors) in which DOS/Windows computers store files. Clusters are made up of sectors
Sectors: smallest unit of storage. Sectors are composed of bits. A regular disk sector is 512 bytes
File
RAM Slack
File Slack

14. Slack Space (2) The default value for NTFS is 8 sectors for 1 cluster.
What happens when this setting is changed?
Allocation unit 512 – 1 cluster contains 1 sector
Allocation unit 64k – 1 cluster contains 128 sectors

15. NTFS

16. NTFS – Overview
NFTS is a proprietary file system developed by Microsoft in 1993; default file system of Windows NT family.
Notable features of NTFS
Security: by using an Access Control List (ACL), an administrator controls who can access specific files.
B-tree: Faster file look up times
Support large file sizes: up to 16-billion-byte files.
Journaling: records metadata changes to the partition.
Encryption: Encrypting File System (EFS) provides strong and user-transparent encryption of any file or folder on an NTFS volume.

17. NTFS - Architecture
Source: NTFS Technical Reference – How NTFS works

18. Master Boot Record Hex 0x0800 = 2048 (decimal)
Master Boot Record is a special type of boot sector at the very beginning of partitioned computer storage devices;
It contains executable code that the system BIOS loads into memory.
The code scans the MBR to find the partition table to determine which partition is the active, or bootable.
Boot signature: 0x55AA
In the partition table
1st byte: 80 bootable/active, 00 inactive
2-4 bytes: Cylinder-Head-Sector (CHS) of first absolute sector in partition
5th byte: partition type (07-NTFS)
6-8 bytes: CHS address of last absolute sector in partition.
9-12 bytes: Logical block addressing of first absolute sector in the partition
Hex 0x0800 = 2048 (decimal)

19. Organization of an NTFS Partition
NTFS Boot Sector
Contains the BIOS parameter block that stores information about the layout of the volume and the file system structures.
Master File Table
Contains the information necessary to retrieve files from the NTFS partition, such as the attributes of a file.
File System Data
Stores data that is not contained within the Master File Table.
Master File Table Copy
Includes copies of the records essential for the recovery of the file system if there is a problem with the original copy.

20. NTFS Boot Sector OEM ID Logical Cluster Number for the file $MFT
The original equipment manufacturer identification (OEM ID).
Sectors Per Cluster (e.g. 8)
0x30:Logical Cluster Number for the file $MFT
0x38:Logical Cluster Number for the file $MFTMirr
Sectors Per Cluster
Logical Cluster Number for the file $MFTMirr

21. Master File Table
Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT)
Starting location of the MFT is given in the boot sector;
12.5% of space allocated but only used when necessary
Each entry is 1024 bytes (1KB)
Only first 42 bytes defined, containing 12 fields
The rest are allocated to numerous/various attributes
First field is the signature – standard – FILE

22. MFT Metadata Files Entry Filename Description $MFT
$MFT
The entry for the MFT itself 1
$MFTMirr
Backup of the MFT 2
$LogFile
Journal containing records of metadata transactions 3
$Volume
Volume information 4
$AttrDef
Attribute information (identifier values, name) 5 $.
Root directory of the file system 6
$Bitmap
Allocation status of each cluster in the file system 7
$Boot
Boot sector and boot code for the file system 8
$BadClus
Clusters that have bad sectors 9
$Secure
Security and access control for the files 10
$Upcase
Contains the uppercase version of every Unicode character 11
$Extend
Directory containing files for optional extensions

23. MFT Entry Attribute Concepts
NTFS exists to read attributes – not files – files are simply one of the attributes
Attributes consist of a header and content
Content: Resident and non-resident attributes
MFT Entry
Attribute Header
Attribute Content
Free Space

24. MFT Entry Attribute Types
Type ID
Name
Description 16
$STANDARD_INFORMATION
General – MACs; Owner, Security ID 32
$ATTRIBUTE_LIST
List of attributes and locations 48
$FILE_NAME
File Name 80
$SECURITY_DESCRIPTOR
Access control and security properties
128
$DATA
File Contents
144
$INDEX_ROOT
Root node of an index tree
160
$INDEX_ALLOCATION
Nodes of an index tree root in $INDEX_ROOT
176
$BITMAP
A Bitmap for the MFT file/indexes

25. B-Tree Sorting
A B-tree is a method of placing and locating files in a file system. It minimises the number of times a medium must be accessed to locate a desired record, hence speeding up the process. 20 10 30 5 11

26. File Allocation Creating a file – c:\dir1\file1.dat
File size 4,000 bytes and each cluster is 2, 048 bytes
Read first sector of the file system and the boot sector to determine the cluster size, starting address of the MFT and the size of each MFT entry
Read the first entry of the MFT to determine the layout of the rest of the MFT (stored in $DATA attribute)
Allocate a MFT entry for the new file. Process the $BITMAP attribute of the $MFT file. The first free entry (304) is allocated to the new file and the corresponding bit is set to 1

27. File Allocation
Initialize MFT entry 304 by seeking its location in the MFT and clearing its contents. The $STANDARD_INFORMATION and $FILE_NAME attributes are created, and the times are set to the current time. The in-use flag is set in the MFT entry header
Using the $DATA attribute of the $Bitmap file, which is MFT entry 6, allocate two consecutive clusters. The corresponding bits for the clusters are set to 1. The file content is written to the clusters and the $DATA attribute is updated with the cluster addresses. MFT entry is modified and file modified times are updated

28. File Allocation
Add a file name entry. The root directory, in MFT entry 5, is processed to locate dir1. Read the $INDEX_ROOT and $INDEX_ALLOCATION attributes and transverse the sorted tree. The dir1 is found and its MFT entry is 200. The last accessed time of the directory is updated
Seek MFT entry 200 and process its $INDEX_ROOT attribute to find the location of where file1.dat should go. A new index is created for it and the tree is resorted. The new index entry has the MFT entry 304 in its file reference address and the times and flags are set appropriately. The last written, modified and accessed times are updated for the directory.

29. File Allocation

30. Conclusions

31. Conclusions
A forensic examiner must have an excellent working knowledge of the system and software with which s/he is examining
Modern OS’s are complex with many interactions being performed for simple operations
Due to these complexities it is not possible to know what value the OS might provide in terms of evidence
However typically, it can be a good source of additional evidence, beyond simple file analysis

32. Dr Fudong Li