110 likes | 363 Views
Moshe Caplan moshecaplan@isis.poly.edu Summer 2012. Scalpel. *Presentation partially based on material created by Moshe Kaplan (moshekaplan@isis.poly.edu) and material created for the 2012 CSAW Cybersecurity Summer Bootcamp:
E N D
Moshe Caplan moshecaplan@isis.poly.edu Summer 2012 Scalpel *Presentation partially based on material created by Moshe Kaplan (moshekaplan@isis.poly.edu) and material created for the 2012 CSAW Cybersecurity Summer Bootcamp: https://sites.google.com/a/isis.poly.edu/cyfor/hsf-teacher-summer-bootcamp/hsf-teacher-summer-bootcamp---day-3
Background • When a file is deleted: • Oftentimes the file is only MARKED as deleted • The actual data bytes are NOT overwritten • File Carving • Reconstructing files by scanning the raw bytes of the disk and reassembling them • Usually done by examining the header (first few bytes) and footer (last few bytes) of a file • Pro: Filesystem independent • Con: Recovering fragmented files is difficult
Obtaining scalpel • Preinstalled on CERT Fedora • Executed from the command line • Can also be obtained from: • http://www.digitalforensicssolutions.com/Scalpel/ • See the “Synopsis” section of this module for more specific directions
scalpel.conf (1) • Configuration file • Specifies the file formats to look for • Watch out for false positives • Default conf has all formats commented out • On CERT Fedora stored in /etc • We make our own configuration file • Specify to use ours with -c option
scalpel.conf (2) • Configuration entry • <extension> <header & footer case sensitive> <size [min:]max> <header> [footer] • Searching for jpeg files • jpg y 20000000 \xff\xd8\xff\xe0\x00\x10 \xff\xd9 • jpg y 20000000 \xff\xd8\xff\xe1 \xff\xd9 • \x specifies hexadecimal values • These are possible signatures for jpeg files
jpeg With Header Signature • I opened a jpeg file with a hex editor • Notice the header signature matches one of the entries on the previous slide
Running scalpel • I put two jpgs on a usb drive, deleted them, and ran dd on the drive • scalpel options: • -c specifies config file • -o specifies output directory • must either be empty or not exist • Format: • scalpel options input_image