130 likes | 255 Views
Volume analysis. System Forensics Applied Computing Yr 3. Steven Davy. Where are we ?. Overview. Volume Concepts. Volume Concepts. To separate a Hard Drive into File Systems. Volume Concepts. Partitions and Volumes Partitions are physically laid out on a disk
E N D
Volume analysis System Forensics Applied Computing Yr 3 Steven Davy
Where are we ? System Forensics : Applied Computing Year 3
Overview • Volume Concepts System Forensics : Applied Computing Year 3
Volume Concepts • To separate a Hard Drive into File Systems System Forensics : Applied Computing Year 3
Volume Concepts • Partitions and Volumes • Partitions are physically laid out on a disk • Volumes are virtual separation of disk space • Start, End sector addresses mark the start and finish of partitions on a disk, this is stored in a ‘Partition Table’ • WARNING: If the partition table becomes corrupt we may lose the entire file system… but why? System Forensics : Applied Computing Year 3
Windows vs Linux Volumes System Forensics : Applied Computing Year 3
Analysing Volumes • When analysing volumes on a hard drive we need to be aware of the following methods • Consistency checks • Extracting Volume Contents • Recovering Deleted Partitions System Forensics : Applied Computing Year 3
Consistency Checks • Volume layout in a hard drive must follow some basic rules • For example two volumes cannot share the same space on a hard drive System Forensics : Applied Computing Year 3
Extracting Volumes • We can use the data dump tool ‘dd’ to extract data from disk images • To extract specific volumes from a disk image we need to understand the partition table of the disk. • We can use mmls, to recognise the partition tables and we can use the dd to extract individual partitions. System Forensics : Applied Computing Year 3
Extracting volumes • For the following partition table we can extract the following volumes dd if=disk.dd of=part1.dd skip=63 count=966 63 - 1028 1028 - 2570 FAT NTFS EFS None 2570 - 5120 0-63 1028 - 2570 System Forensics : Applied Computing Year 3
Recovering Volumes • Criminals may re-partition a hard drive to make it harder to discover evidence • However tools exist that can recover partitions. • Analysis of the data stored in sectors on the disk may indicate where partition boundaries exist, so called magic patterns • Example: FAT file systems always have a specific bit pattern 0x55AA at the beginning of the partition • ‘gpart’ is a tool provided by linux that can recover lost partitions System Forensics : Applied Computing Year 3
More about Partitions • DOS partitions are used by Microsoft DOS, Microsoft Window, Linux, FreeBSD and OpenBSD • Apple use their own partitions for their Operating System System Forensics : Applied Computing Year 3