1. COS/PSA 413 Day 3

2. Guide to Computer Forensics and Investigations, 2e2 Agenda Questions? Assignment 1 due Lab Write-ups (project 2-1 and 2-2) due next class Lab Recap and After Action Report Begin Discussion on Working with Windows and DOS Systems –Chapter 3 in 1e and Chapter 7 in 2e

3. Guide to Computer Forensics and Investigations, 2e3 Lab 1 Recap Always know what are going to do before you sit down at the forensics workstations –Methodical not “hack and slash” –Requires reading and prior prep Learn DOS –Most forensics work is down at low levels (not GUI) –http://www.glue.umd.edu/~nsw/ench250/dostutor.ht mhttp://www.glue.umd.edu/~nsw/ench250/dostutor.ht m Have part of the lab report started before the lab –Know what it is you are looking for

4. Guide to Computer Forensics and Investigations Chapter 3 Working with Windows and DOS Systems

5. Guide to Computer Forensics and Investigations, 2e5 Objectives Understand file systems Explore Microsoft file structures Examine New Technology File System (NTFS) disks

6. Guide to Computer Forensics and Investigations, 2e6 Objectives (continued) Understand the Windows Registry Understand Microsoft boot tasks Understand MS-DOS startup tasks

7. Guide to Computer Forensics and Investigations, 2e7 Understanding File Systems Understand how OSs work and store files CompTIA A+ certification File system –Road map to data on a disk –Determines how data is stored on disk Become familiar with file systems

8. Guide to Computer Forensics and Investigations, 2e8 Understanding the Boot Sequence Avoid data contamination or modification Complementary Metal Oxide Semiconductor (CMOS) –Stores system configuration, data, and time BIOS –Performs input/output at hardware level

9. Guide to Computer Forensics and Investigations, 2e9 Understanding the Boot Sequence (continued) Make sure computer boots from a floppy disk –Modify CMOS –Accessing CMOS depends on the BIOS Delete key Ctrl+Alt+Insert Ctrl+A Ctrl+F1 F2 F12

10. Guide to Computer Forensics and Investigations, 2e10 Understanding the Boot Sequence (continued)

11. Guide to Computer Forensics and Investigations, 2e11 Understanding Disk Drives Composed of one or more platters Elements of a disk: –Geometry –Head –Tracks –Cylinders –Sectors

12. Guide to Computer Forensics and Investigations, 2e12 Understanding Disk Drives (continued)

13. Guide to Computer Forensics and Investigations, 2e13 Understanding Disk Drives (continued) Cylinder, head, sector (CHS) calculation –512 bytes per sector –Tracks contain sectors –Number of bytes on a disk Cylinders (platters) x Heads (tracks) x sectors First track is track 0 –So if a disc list 79 tracks (like a floppy) does, it has 80 tracks

14. Guide to Computer Forensics and Investigations, 2e14

15. Guide to Computer Forensics and Investigations, 2e15 Understanding Disk Drives (continued) Zoned bit recording (ZBR) –Platter’s inner tracks are smaller than outer tracks –Group tracks by zone Track density –Space between each track Areal density –Number of bits on one square inch of a platter

16. Guide to Computer Forensics and Investigations, 2e16 Exploring Microsoft File Structures Need to understand –FAT –NTFS Sectors are grouped on clusters –Storage allocation units of at least 512 bytes –Minimize read and write overhead Clusters are referred to as logical addresses Sectors are referred to as physical addresses

17. Guide to Computer Forensics and Investigations, 2e17 Disk Partitions Logical drive Hidden partitions or voids –Large, unused gaps between partitions –Also known as partition gaps –Can hide data Use a disk editor to change partitions table –Norton Disk Edit –WinHex, Hex Workshop –http://www.x-ways.net/winhex/index-m.htmlhttp://www.x-ways.net/winhex/index-m.html

18. Guide to Computer Forensics and Investigations, 2e18 Disk Partitions (continued)

19. Guide to Computer Forensics and Investigations, 2e19 Disk Partitions (continued) Disk editor additional functions –Identify OS on an unknown disk –Identify file types

20. Guide to Computer Forensics and Investigations, 2e20 Disk Partitions (continued)

21. Guide to Computer Forensics and Investigations, 2e21

22. Guide to Computer Forensics and Investigations, 2e22 Disk Partitions (continued)

23. Guide to Computer Forensics and Investigations, 2e23

24. Guide to Computer Forensics and Investigations, 2e24 Master Boot Record Stores information about partitions –Location –Size –Others Software can replace master boot record (MBR) –PartitionMagic –LILO –Can interfere with forensics tasks –Use more than one tool

25. Guide to Computer Forensics and Investigations, 2e25 Examining FAT Disks FAT was originally developed for floppy disks –Filenames, directory names, date and time stamps, starting cluster, attributes Typically written to the outermost track Evolution –FAT12 –FAT16 –FAT32

26. Guide to Computer Forensics and Investigations, 2e26 Examining FAT Disks (continued)

27. Guide to Computer Forensics and Investigations, 2e27 Examining FAT Disks (continued) Drive slack –Unused space on a cluster –RAM slack Can contain logon IDs and passwords Common on older systems –File slack Bytes not used on the sector by the file FAT16 unintentionally reduced fragmentation

28. Guide to Computer Forensics and Investigations, 2e28 Examining FAT Disks (continued)

29. Guide to Computer Forensics and Investigations, 2e29 Examining FAT Disks (continued) Cluster chaining –File clusters are together (when possible) Produces fragmentation Tools –Norton DiskEdit –DriveSpy’s Chain Fat Entry (CFE) command Rebuilding broken chains can be difficult

30. Guide to Computer Forensics and Investigations, 2e30 Examining FAT Disks (continued)

31. Guide to Computer Forensics and Investigations, 2e31

32. Guide to Computer Forensics and Investigations, 2e32 Deleting FAT Files Filename in FAT database starts with HEX E5 FAT chain for that file is set to zero Free disk space is incremented Actual data remains on disk Can be recovered with computer forensics tools

33. Guide to Computer Forensics and Investigations, 2e33 Examining NTFS Disks First introduced with Windows NT Spin off HPFS –From IBM O/S 2 Provides improvements over FAT file systems –Stores more information about a file Microsoft’s move toward a journaling file system –Keep track of transactions –Can be rolled back

34. Guide to Computer Forensics and Investigations, 2e34 Examining NTFS Disks (continued) Partition Boot Sector starts at sector 0 Master File Table (MFT) –First file on disk –Contains information about all files on disk (meta-data) Reduces slack space NTFS uses Unicode –UTF-8, UTF-16, UTF-32

35. Guide to Computer Forensics and Investigations, 2e35 Examining NTFS Disks (continued)

36. Guide to Computer Forensics and Investigations, 2e36 NTFS File Attributes All files and folders have attributes Resident attributes –Stored in the MFT Nonresident attributes –Everything that can be stored on the MFT Uses inodes for nonresident attributes Logical and virtual cluster numbers –LCN and VCN

37. Guide to Computer Forensics and Investigations, 2e37 NTFS Data Streams Data can be appended to a file when examining a disk –Can obscure valuable evidentiary data Additional data attribute of a file Allow files be associated with different applications

38. Guide to Computer Forensics and Investigations, 2e38 NTFS Compressed Files Improve data storage –Compression similar to FAT DriveSpace 3 File, folders, or an entire volume can be compressed Transparent when working with Windows XP, 2000, or NT Need to decompress it when analyzing –Advanced tools do it automatically

39. Guide to Computer Forensics and Investigations, 2e39 NTFS Encrypted File System (EFS) Introduced with Windows 2000 Implements a public key/private key encryption method Recovery certificate –Recovery mechanisms in case of a problem Works for local workstations or remote servers

40. Guide to Computer Forensics and Investigations, 2e40 Deleting NTFS Files Similar to FAT NTFS is more efficient than FAT –Reclaiming deleted space –Deleted files are overwritten more quickly

41. Guide to Computer Forensics and Investigations, 2e41 Understanding the Windows Registry Database that stores: –Hardware and software configuration –User preferences (user names and passwords) –Setup information Use Regedit command for Windows 9x Use Regedt32 command for Windows XP and 2000 FTK Registry Viewer

42. Guide to Computer Forensics and Investigations, 2e42 Understanding the Windows Registry (continued) Windows 9x Registry –User.dat –System.dat Windows 2000 and XP Registry –\Winnt\System32\Config –\Windows\System32\Config –System, SAM, Security, Software, and NTUser.dat

43. Guide to Computer Forensics and Investigations, 2e43 Understanding the Windows Registry (continued)

44. Guide to Computer Forensics and Investigations, 2e44 Understanding Microsoft Boot Tasks Prevent damaging digital evidence OSs alter files when computer starts up

45. Guide to Computer Forensics and Investigations, 2e45 Windows XP, 2000 and NT Startup Steps: –Power-on self test (POST) –Initial startup –Boot loader –Hardware detection and configuration –Kernel loading –User logon

46. Guide to Computer Forensics and Investigations, 2e46 Startup Files for Windows XP Files used during boot process: –NTLDR –Boot.ini –BootSec.dos –NTDetect.com –NTBootdd.sys –Ntoskrnl.exe –Hal.dll –Device drivers

47. Guide to Computer Forensics and Investigations, 2e47 Windows XP System Files

48. Guide to Computer Forensics and Investigations, 2e48 Windows 9x and Me Startup Windows Me cannot boot to a true MS-DOS mode Windows 9x OSs have two modes –DOS protected-mode interface (DPMI) Command prompt from boot menu –Protected-mode GUI Dos shell in windows Startup files –Io.sys –Msdos.sys –Command.com

49. Guide to Computer Forensics and Investigations, 2e49 Windows 9x and Me Startup (continued)

50. Guide to Computer Forensics and Investigations, 2e50 Understanding MS-DOS Startup Task Io.sys –Loaded after the ROM bootstrap –Finds the disk drive –Provides basic input/output services Msdos.sys –Loaded after Io.sys –Actual kernel for MS-DOS –Looks for Config.sys

51. Guide to Computer Forensics and Investigations, 2e51 Understanding MS-DOS Startup Task (continued) Msdos.sys (continued) –Loads Command.com –Loads Autoexec.bat Config.sys –Commands run only at system startup Autoexec.bat –Customized setting for MS-DOS –Define default path and environmental variables

52. Guide to Computer Forensics and Investigations, 2e52 Other Disk Operating Systems Control Program for Microprocessors (CP/M) Digital Research Operating System (DR-DOS) Personal Computer Disk Operating System (PC- DOS) –Developed by IBM

53. Guide to Computer Forensics and Investigations, 2e53 DOS Commands and Batch Files Batch files –Fixed sequence of DOS commands –Ideal for repetitive tasks Batch files work like a single command MS-DOS supports parameter passing and conditional execution –Can pass up to 10 parameters

54. Guide to Computer Forensics and Investigations, 2e54 DOS Commands and Batch Files (continued)

55. Guide to Computer Forensics and Investigations, 2e55 DOS Commands and Batch Files (continued)

56. Guide to Computer Forensics and Investigations, 2e56 Summary FAT –FAT12, FAT16, and FAT32 Windows Registry keeps hardware and software configuration and preferences CHS calculation NTFS Look for hidden information on file, RAM, and drive slack

57. Guide to Computer Forensics and Investigations, 2e57 Summary (continued) NTFS uses Unicode to store information Hexadecimal codes identify OSs and file types NTFS uses inodes to link file attribute records –Resident and nonresident NTFS compressed files NTFS encrypted files (EFS)