book

File System Forensic Analysis

by Brian Carrier

March 2005

Beginner to intermediate

600 pages

16h 26m

English

Addison-Wesley Professional

Read now

Unlock full access

RoadmapScope of BookResources
Digital Investigations and EvidenceDigital Crime Scene Investigation ProcessSystem Preservation PhaseEvidence Searching PhaseEvent Reconstruction PhaseGeneral GuidelinesData AnalysisAnalysis TypesEssential and Nonessential DataOverview of ToolkitsEnCase by Guidance SoftwareForensic Toolkit by AccessDataProDiscover by Technology PathwaysSMART by ASR DataThe Sleuth Kit / AutopsySummaryBibliography

Data OrganizationBinary, Decimal, and HexadecimalData SizesStrings and Character EncodingData StructuresFlag ValuesBooting ProcessCentral Processing Units and Machine CodeBoot Code LocationsHard Disk TechnologyHard Disk Geometry and InternalsATA / IDE InterfaceTypes of Sector AddressesBIOS versus Direct AccessSCSI DrivesSummaryBibliography
IntroductionGeneral Acquisition ProcedureData Acquisition LayersAcquisition Tool TestingReading the Source DataDirect versus BIOS AccessDead versus Live AcquisitionError HandlingHost Protected AreaDevice Configuration OverlayHardware Write BlockersSoftware Write BlockersWriting the Output DataDestination LocationImage File FormatCompressing the Image FileNetwork-based AcquisitionIntegrity HashesA Case Study Using ddInput SourcesHPAOutput DestinationsError HandlingCryptographic HashesSummaryBibliography
IntroductionBackgroundVolume ConceptsGeneral Theory of PartitionsUsage of Volumes in UNIXGeneral Theory of Volume AssemblySector AddressingAnalysis BasicsAnalysis TechniquesConsistency ChecksExtracting the Partition ContentsRecovering Deleted PartitionsSummary
DOS PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummaryApple PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummaryRemovable MediaBibliography
BSD PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummarySun Solaris SlicesGeneral OverviewSparc Data Structuresi386 Data StructuresAnalysis ConsiderationsSummaryGPT PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummaryBibliography
RAIDRAID LevelsHardware RAIDSoftware RAIDGeneral Analysis CommentsSummaryDisk SpanningOverviewLinux MDLinux LVMMicrosoft Windows LDMBibliography
What Is a File System?Data CategoriesEssential and Non-Essential DataAnalysis by CategoryFile System CategoryAnalysis TechniquesContent CategoryGeneral InformationAnalysis TechniquesWiping TechniquesMetadata CategoryGeneral InformationAnalysis TechniquesFile Name CategoryGeneral InformationAnalysis TechniquesWiping TechniquesApplication CategoryFile System JournalsApplication-level Search TechniquesApplication-based File Recovery (Data Carving)File Type SortingSpecific File SystemsSummaryBibliography
IntroductionFile System CategoryAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioContent CategoryAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioMetadata CategoryAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenariosFile Name CategoryAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenariosThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryDetermining the TypeConsistency CheckSummaryBibliography
Boot SectorFAT32 FSINFOFATDirectory EntriesLong File Name Directory EntriesSummaryBibliography
IntroductionEverything is a FileMFT ConceptsMFT Entry ContentsMFT Entry AddressesFile System Metadata FilesMFT Entry Attribute ConceptsAttribute HeadersAttribute ContentStandard Attribute TypesOther Attribute ConceptsBase MFT EntriesSparse AttributesCompressed AttributesEncrypted AttributesIndexesB-TreesNTFS Index AttributesAnalysis ToolsSummaryBibliography
File System Category$MFT File Overview$MFTMirr File Overview$Boot File Overview$Volume File Overview$AttrDef File OverviewExample ImageAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioContent CategoryClusters$Bitmap File Overview$BadClus File OverviewAllocation AlgorithmsFile System LayoutAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioMetadata Category$Standard_Information Attribute$FILE_NAME Attribute$DATA Attribute$ATTRIBUTE_LIST Attribute$SECURITY_DESCRIPTOR Attribute$Secure FileExample ImageAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioFile Name CategoryDirectory IndexesRoot DirectoryLinks to Files and DirectoriesObject IdentifiersAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioApplication CategoryDisk QuotasLogging—File System JournalingChange JournalThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryConsistency CheckSummaryBibliography
Basic ConceptsFixup ValuesMFT Entries (File Records)Attribute HeaderStandard File Attributes$STANDARD_INFORMATION Attribute$FILE_NAME Attribute$DATA Attribute$ATTRIBUTE_LIST Attribute$OBJECT_ID Attribute$REPARSE_POINT AttributeIndex Attributes and Data Structures$INDEX_ROOT Attribute$INDEX_ALLOCATION Attribute$BITMAP AttributeIndex Node Header Data StructureGeneric Index Entry Data StructureDirectory Index Entry Data StructureFile System Metadata Files$MFT File$Boot File$AttrDef File$Bitmap File$Volume File$ObjId File$Quota File$LogFile File$UsrJrnl FileSummaryBibliography
IntroductionFile System CategoryOverviewAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioContent CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioMetadata CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioFile Name CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenariosApplication CategoryFile System JournalingAnalysis ScenarioThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryConsistency CheckSummaryBibliography
SuperblockGroup Descriptor TablesBlock BitmapInodesExtended AttributesDirectory EntrySymbolic LinkHash TreesJournal Data StructuresSummaryBibliography
IntroductionFile System CategoryOverviewAnalysis TechniquesAnalysis ConsiderationsContent CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsMetadata CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsFile Name CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryConsistency CheckSummaryBibliography
UFS1 SuperblockUFS2 SuperblockCylinder Group SummaryUFS1 Group DescriptorUFS2 Group DescriptorBlock and Fragment BitmapsUFS1 InodesUFS2 InodesUFS2 Extended AttributesDirectory EntriesSummaryBibliography
The Sleuth KitDisk ToolsVolume System ToolsFile System ToolsSearching ToolsAutopsyAnalysis ModesBibliography

Content preview from File System Forensic Analysis

11. NTFS Concepts

The New Technologies File System (NTFS) was designed by Microsoft and is the default file system for Microsoft Windows NT, Windows 2000, Windows XP, and Windows Server. At the time of this writing, Microsoft has discontinued the sale of the Windows 98 and ME lines, and the home version of Windows XP is standard among new consumer systems. FAT will still exist in mobile and small storage devices, but NTFS will likely be the most common file system for Windows investigations. NTFS is a much more complex file system than FAT because it has many features and is very scalable. Because of the complexity of NTFS, we will need three chapters to discuss it. This chapter discusses the core concepts of NTFS that apply to all the five categories ...