Suppose we have a file system with a contents area of 32 sectors, where each cluster is 4 sectors. The following modifications are done to the file system:
mike05
6-FileSystemAnalysis.pdf
FILE SYSTEM ANALYSIS
CSCI 352 – Digital Forensics
Resource
Chapter 8:
File System Forensic Analysis, 2nd edition, Brian
Carrier, 2005.
File System Analysis
What is a file system?
File System Analysis
Simple Example:
Suppose we have 2 sections of the same class
There is a midterm exam
File System Analysis
What is file system analysis?
File System Analysis
Examples:
Search for files with “.jpg" extension
Search for files that contains certain keyword
Recover deleted files
Search for files that were created by a specific user
Retrieve contents from the slack space
File System Abstraction Model
Disk
Partition/Volume
Data Unit
File System - Organization
File system
Content
Metadata
File name
Application data
File System Category
File system data
Layout information
Analysis:
Volume slack
Any other type of analysis
Content Category
Content Data
File and directory data
Organized into equal sized blocks
Require tools to inspect its contents
Addressing Scheme
Physical addresses
Logical volume addresses
Logical file system addresses
Logical file addresses
Addressing Scheme
From: File System Forensic Analysis, 2nd edition, Brian Carrier
Addressing Scheme
From: File System Forensic Analysis, 2nd edition, Brian Carrier
Addressing Scheme
What is a fragmented file?
Addressing Scheme
Allocation Strategy
First available
Next available
Best fit
Allocation Strategy
Suppose we have a file system with a contents area
of 8 sectors, where each cluster is 2 sectors. The
following modifications are done to the file system:
1. created a.txt (3 sectors)
2. deleted a.txt
3. created b.txt (size: 1 sector)
4. created c.txt (2 sectors)
Allocation Strategy
Content Analysis
Block analysis
Allocation status
Consistency checks
Allocation Bitmap
From: File System Forensic Analysis, 2nd edition, Brian Carrier
Consistency Checks
From: File System Forensic Analysis, 2nd edition, Brian Carrier
Metadata Category
Metadata
Metadata
Metadata Analysis
Metadata lookup
Slack space analysis
Deleted file Recovery
Slack Space
1. between the end of the file and the end of the
sector where the file ends
2. in the sectors that contain no file content
Slack Space
Slack Space
File Name Category
File Name Analysis
name-based file recovery
File Name Analysis
Listing of file/directory names
Searching for file names
Finding the metadate
Retrieving a file
File Name Analysis
References
1. File System Forensic Analysis, 2nd edition, Brian
Carrier, 2005.
2. Digital Forensics with Open Source Tools, by Cory
Altheide, Harlan Carvey, 2011.
