Introduction to filesystems and computer forensics
Download as PPTX, PDF2 likes2,358 views
The document provides an overview of filesystems and computer forensics, detailing what constitutes a file and filesystem, as well as common examples and their management aspects. It explains the FAT filesystem architecture, including its components and boot processes, while addressing the importance of computer forensics in legal contexts and outlining the phases of forensic investigations. Techniques such as cross-drive analysis, live analysis, and recovering deleted files are discussed to illustrate methods used in forensic examinations.
![THE FORENSICS PROCESS MODEL
The U.S. Department of Justice published a process model in the Electronic Crime Scene
Investigation: A guide to first responders[5] that consists of four phases: -
1. Collection; which involves the evidence search, evidence recognition, evidence collection
and documentation.
2. Examination; this is designed to facilitate the visibility of evidence, while explaining its
origin and significance. It involves revealing hidden and obscured information and the
relevant documentation.](https://image.slidesharecdn.com/ydk8lbqoqnqkjlm1vglo-signature-dbb5df9dbe201415d3d4f17d3cb0cfef4a63c044734f65ff36b4e7ed271afc3c-poli-141122070051-conversion-gate01/85/Introduction-to-filesystems-and-computer-forensics-34-320.jpg)
Introduction to filesystems and computer forensics
- 1. INTRODUCTION TO FILESYSTEMS AND COMPUTER FORENSICS BY: MAYANK CHAUDHARI DEPARTMENT OF COMPUTER ENGINEERING COLLEGE OF TECHNOLOGY PANTNAGAR(GBPUAT)
- 2. FIRST THING FIRST DATA • Facts and statics collected together for reference and analysis. INFORMATION • facts provided or learned about something or someone. FILE • A computer file is a resource for storing information, which is available to a computer program and is usually based on some kind of durable storage. A file is "durable" in the sense that it remains available for other programs to use after the program that created it has finished executing.
- 3. WHAT IS A FILE SYSTEM ? A filesystem is the methods and data structures that an operating system uses to keep track of files on a disk or partition; that is, the way the files are organized on the disk. The word is also used to refer to a partition or disk that is used to store the files or the type of the filesystem. It is responsible for arranging storage space; reliability, efficiency, and tuning with regard to the physical storage medium are important design considerations.
- 4. COMMON FILESYSTEMS WINDOWS BASED FILESYSTEMS FAT, NTFS , exFAT. LINUX BASED FILESYSTEMS ext, ext2 , ext3, ext4. MAC BASED FILESYSTEMS HFS, HFS+, LisaFS. OTHERS : Reiser-4, ReiserFS, ZFS, HPFS, etc.
- 5. ASPECTS OF FILESYSTEM Space management The file system is responsible for organizing files and directories, and keeping track of which areas of the media belong to which file and which are not being used. One common issue related to it is fragmentation. Filenames A filename (or file name) is used to identify a storage location in the file system. Most file systems have restrictions on the length of filenames.
- 6. Directories File systems typically have directories (also called folders) which allow the user to group files into separate collections. This may be implemented by associating the file name with an index in a table of contents or an inode in a Unix-like file system. Metadata Other bookkeeping information is typically associated with each file within a file system
- 7. FAT (FILE ALLOCATION TABLE) • File Allocation Table (FAT) is a computer file system architecture and a family of industry-standard file systems utilizing it. • The FAT file system is a legacy file system which is simple and robust. It offers good performance even in light-weight implementations, but cannot deliver the same performance, reliability and scalability as some modern file systems. • The name of the file system originates from the file system's prominent usage of an index table, the File Allocation Table (FAT), statically allocated at the time of formatting.
- 8. • The FAT file system is named for its method of organization, the file allocation table, which resides at the beginning of the volume. To protect the volume, two copies of the table are kept, in case one becomes damaged. • In addition, the file allocation tables and the root folder must be stored in a fixed location so that the files needed to start the system can be correctly located. • A volume formatted with the FAT file system is allocated in clusters. The default cluster size is determined by the size of the volume. For the FAT file system, the cluster number must fit in 16 bits and must be a power of two.
- 10. FAT COMPONENTS Hard disk: Contains one or more partitions. Boot sector: Bootable partition that stores information about the layout of the volume and the file system structures, as well as the boot code that loads Ntdlr. Master Boot Record: Contains executable code that the system BIOS loads into memory. The code scans the MBR to find the partition table to determine which partition is the active, or bootable, partition.
- 11. Ntldlr.dll : Switches the CPU to protected mode, starts the file system, and then reads the contents of the Boot.ini file. This information determines the startup options and initial boot menu selections. Fastfat.sys : System file driver for FAT16 and FAT32. Ntoskrnl.exe : Extracts information about which system device drivers to load and the load order. Kernel Mode : The processing mode that allows code to have direct access to all hardware and memory in the system. User Mode : The processing mode in which applications run.
- 12. PHYSICAL STRUCTURE OF FAT Clusters and Sectors on a FAT Volume A cluster (or allocation unit) is the smallest amount of disk space that can be allocated to hold a file. Sequence of Clusters on a FAT Volume Clusters are numbered sequentially from the beginning of the partition into logical cluster numbers. Because FAT file system data clusters are located after the BIOS Parameter Blocks (BPB), reserved sectors, and two FAT structures, FAT formatting cannot guarantee that data clusters are aligned on a cluster boundary.
- 14. Boot Sector Contains the BIOS parameter block that stores information about the layout of the volume and the file system structures, as well as the boot code that loads operating system. Reserved Sectors The number of sectors that precede the start of the first FAT, including the boot sector. FAT 1 Original FAT.
- 15. FAT 2 (Duplicate) Backup copy of the FAT. Root folder Describes the files and folders in the root of the partition. Other folders and all files Contains the data for the files and folders within the file system.
- 16. BOOT SECTORS ON MBR AND GPT DISKS On MBR disks the boot sector, which is located at the first logical sector of each partition, is a critical disk structure for starting your computer. It contains executable code and the data required by the code, including information that the file system uses to access the volume. At the end of the boot sector is a 2-byte structure called a signature word or end of sector marker, which is always set to 0x55AA.
- 17. BOOT SECTOR A boot sector consists of the following elements: • An x86-based CPU jump instruction. • The original equipment manufacturer identification (OEM ID). • The BIOS parameter block (BPB), a data structure. • The extended BPB. • The executable boot code (or bootstrap code) that starts the operating system.
- 18. Boot Sector Sections on a FAT32 Volume Byte Offset Field Length Field Name 0x00 3 bytes Jump instruction 0x03 8 bytes OEM ID 0x0B 53 bytes BPB 0x40 26 bytes Extended BPB 0x5A 420 bytes Bootstrap code 0x01FE 2 bytes End of sector marker
- 20. FAT1 AND FAT2 The file allocation table, FAT 1, identifies each cluster in the volume as one of the following: • Unused • Cluster in use by a file • Bad cluster • Last cluster in a file
- 25. FAT PROCESSES AND INTERACTIONS Mounting a FAT Volume When mounting a FAT volume, the MBR executes code to start up the boot sector. The boot sector then executes additional code to mount the volume. Master Boot Code Startup Process The MBR contains a small amount of executable code called the master boot code, the disk signature, and the partition table for the disk. During startup, the master boot code performs the following activities:
- 26. 1. Scans the partition table for the active partition. 2. Finds the starting sector of the active partition. 3. Loads a copy of the boot sector from the active partition into memory. 4. Transfers control to the executable code in the boot sector.
- 27. Boot Sector Startup Process Computers use the boot sector to run instructions during startup. The initial startup process is summarized in the following steps: 1. The system BIOS and the CPU initiate the power-on self test (POST). 2. The BIOS finds the boot device, which is typically the first disk the BIOS finds, unless the controller is configured to boot from a different disk. 3. The BIOS loads the first physical sector of the boot device into memory and transfers CPU execution to that memory address.
- 28. If the boot device is on a hard disk, the BIOS loads the MBR. The master boot code in the MBR loads the boot sector of the active partition, and transfers CPU execution to that memory address. On computers that are running Windows Server 2003, the executable boot code in the boot sector finds Ntldr, loads it into memory, and transfers execution to that file.
- 29. File Processing on FAT Clusters When a file is saved to a FAT-formatted volume, it stores file information in clusters on the hard disk. If a file requires space greater than the cluster’s size, FAT continues to store file information in the next available cluster until all information about the file is stored. The following figure shows an example of how FAT stores and retrieves file information from clusters.
- 30. File Processing on a FAT Volume In this figure, 10 clusters (0 through 9) contain 3 files. One file occupies clusters 2, 3, 6, and 8; a second file occupies clusters 4 and 5; and a third file occupies cluster 7. The starting cluster number is the address of the first cluster used by the file. Each cluster contains a pointer to the next cluster in the file, or an end-of-file indicator (0xFFFF), which indicates that this cluster is the end of the file.
- 31. Formatting Volumes & Converting Volumes During volume format, operating system places key file system structures on the volume, including the boot sector as well as replacing Ntldr. A check of the integrity of all sectors on the volume is performed, and you have the opportunity to change the cluster size used on the volume. If a volume is formatted using Quick format, the file system structure on the volume is created, but the integrity of every sector in the volume is not checked.
- 33. INTRODUCTION Computer forensics (sometimes known as computer forensic science) is a branch of digital forensic science pertaining to legal evidence found in computers and digital storage media. The goal of computer forensics is to examine digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing and presenting facts and opinions about the digital information.
- 34. THE FORENSICS PROCESS MODEL The U.S. Department of Justice published a process model in the Electronic Crime Scene Investigation: A guide to first responders[5] that consists of four phases: - 1. Collection; which involves the evidence search, evidence recognition, evidence collection and documentation. 2. Examination; this is designed to facilitate the visibility of evidence, while explaining its origin and significance. It involves revealing hidden and obscured information and the relevant documentation.
- 35. 3. Analysis; this looks at the product of the examination for its significance and probative value to the case. 4. Reporting; this entails writing a report outlining the examination process and pertinent data recovered from the overall investigation.
- 36. TECHNIQUES A number of techniques are used during computer forensics investigations. Cross-drive analysis A forensic technique that correlates information found on multiple hard drives. The process, still being researched, can be used to identify social networks and to perform anomaly detection.
- 37. Live analysis The examination of computers from within the operating system using custom forensics or existing sysadmin tools to extract evidence. The practice is useful when dealing with Encrypting File Systems, for example, where the encryption keys may be collected and, in some instances, the logical hard drive volume may be imaged (known as a live acquisition) before the computer is shut down.
- 38. Deleted files A common technique used in computer forensics is the recovery of deleted files. Modern forensic software have their own tools for recovering or carving out deleted data. Most operating systems and file systems do not always erase physical file data, allowing investigators to reconstruct it from the physical disk sectors. File carving involves searching for known file headers within the disk image and reconstructing deleted materials
- 39. Link files Link files are created when files are opened from a removable device or from a share on the network. Link files contain metadata including the file path, MAC times (last modified date, access date, etc..) and a serial number for the volume on which the file originated. Forensic investigators can use link files to determine if other computers or devices should be analyzed.
- 40. Volatile data When seizing evidence, if the machine is still active, any information stored solely in RAM that is not recovered before powering down may be lost. One application of "live analysis" is to recover RAM data (for example, using Microsoft's COFEE tool, windd, WindowsSCOPE) prior to removing an exhibit. CaptureGUARD Gateway bypasses Windows login for locked computers, allowing for the analysis and acquisition of physical memory on a locked computer.
- 45. THANK YOU