1 / 18

Digital Forensics

Digital Forensics. Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #9 File Systems September 21, 2009. Outline. Review File Systems Overview Windows File System (for Forensics) References and Review Question Papers for Lecture on September 23, 2009. Review.

iona
Download Presentation

Digital Forensics

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #9 File Systems September 21, 2009

  2. Outline • Review • File Systems Overview • Windows File System (for Forensics) • References and Review Question • Papers for Lecture on September 23, 2009

  3. Review • Lecture 1: Overview of Digital Forensics (Chapter 1 of textbook) • Lecture 2: Information Security Review • Lecture 3: Data Recovery • Lecture 4: Malicious code detection • Lecture 5: Technologies/Services • Lecture 6: Data acquisition, Processing crime scene, Lab Tour • Lecture 7: Honeypots • Lecture 8: Windows File System and Forensics, Encase

  4. Windows File System • Overview of File Systems • Microsoft File Structures • NTFS Disks (New Technology File System) • Partitions, disks, etc. • Other concepts (Registries, startup tasks) • Virtual Machines

  5. File Systems • What is it? • Structure of the data that is stored • Linear file system, Hierarchical file system, etc. • Type of file system determines how the data is stored on disk • File system is part of the OS; a file system is a way for storing and organizing computer files and the data they contain to make it easy to find and access them. • Key aspects of file system include • Boot sequence • Disk drives • File name, metadata, security access • Different types of file systems

  6. File Systems - 2 • Boot sequence • When a suspect’s computer starts, make sure it boots to a forensic floppy disk/CD and not to the hard disk • Booting to the hard disk may overwrite evidence • Make modifications to CMOS setup • Disk drives • Geometry, Head, Tracks, Cylinders, Sectors • Every file has a file name; metadata consists of information about a file, access control policies may be defined on a file • Types of file systems include disk file system, flash file systems, database file systems, network file systems, - - -

  7. File Systems - 3 • File systems typically have directories which associate file names with files, usually by connecting the file name to an index in a file allocation table (FAT in Windows, Inode in Unix) • Directory structures may be flat, or allow hierarchies where directories may contain subdirectories. • In some file systems, file names are structured, with special syntax for filename extensions and version numbers. In others, file names are simple strings • Metadata • The length of the data contained in a file may be stored as the number of blocks allocated for the file or as an exact byte count. • The time that the file was last modified may be stored as the file's timestamp; also file creation time, the time it was last accessed

  8. Microsoft File Structures • Sectors • Sectors are groped to for clusters which are the storage allocations units. • Cluster numbers are logical addresses and section numbers are physical addresses. • Disk Partitions • Hard drive is partitioned. A partition is a logical drive. • Master Boot Record (MBR) • Stores information about the partitions in a disk and their locations, sizes etc. • FAT (File Allocation Table) Disks • Original Microsoft file structure database • NTFS • New Technology File System

  9. NTFS Disks • Overview of NTFS Disks • Newer Microsoft products are based on new Technology File System • Everything written to a disk is considered s file • First data set is the Partition Boot Sector • Next is the Master File Table (similar to FAT) • Uses Unicode • NTFS System Files • The first file MFT ahs information in all the files • Records in MFT are called metadata

  10. NTFS Disks - 2 • NTFS Data Streams • Ways data can be appended to existing files • Can obscure evidence; only way to know there is a data stream is by looking at MFT • NTFS Compressed Files • Provides compression to improve data storage • Encryption • Implements public key/private key method • Whole disk encryption (Chapter 4) for extra protection for certain information such as personal identity numbers. • Performance • tune some of global NTFS parameters to achieve significant increase of disk performance. Other techniques like disk defragmentation could help

  11. NTFS Disks – 3 (Summary) • File Storage Hardware and Disk Organization • Hard Disk Drive Basics • Making Tracks • Sectors and Clusters • Master Boot Record (MBR) • Viruses Can Infect the Master Boot Record • Partition Table • Boot Indicator Field • System ID Field • Starting and Ending Head, Sector, and Cylinder Field • Relative Sectors and Number of Sectors Fields • Logical Drives and Extended Partitions

  12. NTFS Recovery • Why id Partition recovery needed • MBR (Master Boot Record) is damaged • Partition is deleted or Partition Table is damaged • Partition Boot Sector is damaged • Missing or Corrupted System Files • Partition/Drive Recovery • "Physical partition recovery". The goal is to find out the problem and write some information to the proper place on HDD and after that partition becomes visible to OS again. • "Virtual partition recovery". The goal is to determine the critical parameters of the deleted/damaged/overwritten partition and after that enable to scan it and display its content.

  13. NTFS Recovery - 2 • NTFS File Recovery • Disk Scan for deleted entries • Disk Scan is a process of low-level enumeration of all entries in the Root Folders; The goal is to find and display deleted entries. • Defining clusters chain for the deleted entry • To define clusters chain scan drive, going through one by one all allocated and free clusters belonging to the file until the file size equals to the total size of the selected clusters. If the file is fragmented, clusters chain will be composed of several extents. • Clusters chain recovery • After clusters chain is defined read and save contents of the defined clusters to another place verifying their contents.

  14. Other Concepts • Registry • Registry is a database that stores initialization files such as hardware/software configuration, network connections, user preferences, setup information • Set of tools (e.g., Registry editor) to view and modify the data • Start-up tasks • Forensics examiner must have a very good understanding of what happens to the data during start-up. • E.g., What is the process, what are the files involved, etc.

  15. Virtual Machines • An examiner may need lot more space than he has on the machine he is using. The concept of Virtual machine is used it overcome this limitation. • Virtual machine addresses the need for having a variety of resources by creating the representation of another computer on an existing physical computer. • A few files from the other computer is on the examiner’s machine and space ahs to be allocated for this. • Also useful when one upgrades computer, but still has some old applications. Therefore virtual machine of the old OS is created.

  16. References and Review • Chapter 6 of Textbook • http://www.ntfs.com/ • Select an file system of your choice and explain the key concepts that are relevant to a forensics examiner

  17. Papers for Lecture on September 28, 2009Tamper Detection and Forensics Analysis • Richard T. Snodgrass, Stanley Yao and Christian Collberg, "Tamper Detection in Audit Logs," In Proceedings of the International Conference on Very Large Databases, Toronto, Canada, August–September 2004, pp. 504–515. • Tamper Detection in Audit Logs • Did the problem occur? (e.g. similar to intrusion detection) • Kyri Pavlou and Richard T. Snodgrass, "Forensic Analysis of Database Tampering," in Proceedings of the ACM SIGMOD International Conference on Management of Data (SIGMOD), pages 109-120, Chicago, June, 2006. • Who caused the problem (e.g., similar to digital forensics analysis)

  18. Reading for Lecture for September 20thIntelligence Digital Forensics • http://dfrws.org/2006/proceedings/7-Alink.pdf • XIRAF – XML-based indexing and querying for digital forensics http://dfrws.org/2006/proceedings/8-Turner.pdf • Selective and intelligent imaging using digital evidence bags • http://dfrws.org/2006/proceedings/9-Lee.pdf • Detecting false captioning using common-sense reasoning

More Related