1 / 22

Intro to Cyber Crime and Computer Forensics CSE 4273/6273 February 4, 2013

Intro to Cyber Crime and Computer Forensics CSE 4273/6273 February 4, 2013. MISSISSIPPI STATE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE. Nested Data Structures on HD. Hard Drive. Partition. File System. File. Record. Field. What is a volume?. Carrier defines a volume:

pete
Download Presentation

Intro to Cyber Crime and Computer Forensics CSE 4273/6273 February 4, 2013

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Intro to Cyber Crime and Computer Forensics CSE 4273/6273 February 4, 2013 MISSISSIPPI STATE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE

  2. Nested Data Structures on HD Hard Drive Partition File System File Record Field

  3. What is a volume? • Carrier defines a volume: • “… a collection of addressable sectors that an Operating System (OS) or application can use for data storage.” • Sectors in a volume need not be consecutive on one drive, i.e., RAID systems • They should give that impression though • An example of a Volume with consecutive sectors is a single hard drive when you look at the entire drive as the volume. • May be made up of smaller volumes.

  4. Partitions • A partition is a collection of consecutive sectors. • A partition is also a volume, but a volume is not necessarily a partition. • Partitions are used for: • If a particular file system has a maximum size limit for its partition. • Hibernation record keeping • Backup partitions • Different partitions for different operating systems or even different file systems.

  5. Example Hard Disk Volume Partition 1 Partition 2 Partition 3 C: Volume D: Volume E: Volume Figure 4.1, Carrier

  6. Partition Tables Figure 4.2, Carrier

  7. Partitions in General • Purpose of a partition system is to organize the layout of a volume. • It is essential to know the starting and ending location of a partition. • The book describes them like property lines. If you don’t know where they are, it is kind of difficult to decide whose land you are on. • Partition system is dependent on the operating system and not the Hard Drive interface. • SATA or IDE does not matter.

  8. Typical Windows vs. Unix Windows Unix C: Volume 1 Volume 1 /etc/ \Program Files\ CD-ROM \Windows\ /mnt/cdrom/ Volume 2 D: /tmp/ Volume 2 /usr/ CD-ROM E: Figure 4.3, Carrier

  9. Sector Addressing • Physical Address • Exactly where is it on the disk? • Logical Disk Volume Address • If there are multiple disks, where is it on the disk volume that you are on? • Logical Partition Address • What is its location relative to the start of the partition?

  10. Sector Addressing Partition 1 Starting Address: 0 Partition 2 Starting Address: 864 Physical Address: 964 Logical Disk Volume Address: 964 Logical Partition Volume Address: 100 Physical Address: 100 Logical Disk Volume Address: 100 Logical Partition Volume Address: 100 Physical Address: 569 Logical Disk Volume Address: 569 Logical Partition Volume Address: N/A Figure 4.5, Carrier

  11. Volume Analysis Volume analysis starts with knowing where the partitions are, so the partition tables have to be located and analyzed to see the layout. Once you have the layout, determine where the partitions start and stop, and if there are any parts of the volume that are not in a partition. If there are merged volumes, you will need to access the data structures with the merging information to determine which volumes are merged. 11

  12. Consistency Checking This step is used to determine where the partitions are relative to the other partitions. This allows the analyst to determine if there is potential evidence outside of the partitions. A series of sanity checks is used for this. 12

  13. Sanity Checks Partition 1 Partition 2 • Look to see if the last partition ends with the last sector of the volume. • If it does not, you have this: 13 Carrier, Fig. 4.6

  14. Sanity Checks Partition 1 Partition 2 Partition 1 Partition 2 Partition 1 Partition 2 Partition 1 Partition 2 Next, check to see where the consecutive partitions end and begin: 14 Carrier, Fig. 4.6

  15. Extracting Partition Data • dd can be used to extract exactly which sectors you want from a disk: • dd if=disk1 of=part1 bs=512 skip=63 count=1928097 • if – input file (original disk) • of – output file (file to contain recovered partition) • bs – block size (default is 512) • skip – number of blocks of size bs to skip over at the beginning • count – number of blocks to copy 15

  16. DOS Partitions • Most common style • Master Boot Record Systems • Contains boot code, partition table, and a signature value (1st 446 bytes) • Boot code contains boot instructions and points to the partition table. • Partition Table 16

  17. Data Structures 17 Carrier, Table 5.1

  18. Data Structures for Partition Entries 18 Carrier, Table 5.2

  19. Partition Table • Four entries (4 partitions) • Each entry has the following fields: • Starting CHS address • Ending CHS address • Starting LBA address • Number of sectors in partition • Type of partition • Flags 19

  20. Partitions Primary Partitions Extended Partitions 20

  21. Other Partition Systems Apple Partitions BSD Partitions Solaris Slices … 21

  22. Questions?

More Related