book

File System Forensic Analysis

by Brian Carrier

March 2005

Beginner to intermediate

600 pages

16h 26m

English

Addison-Wesley Professional

Read now

Unlock full access

RoadmapScope of BookResources
Digital Investigations and EvidenceDigital Crime Scene Investigation ProcessSystem Preservation PhaseEvidence Searching PhaseEvent Reconstruction PhaseGeneral GuidelinesData AnalysisAnalysis TypesEssential and Nonessential DataOverview of ToolkitsEnCase by Guidance SoftwareForensic Toolkit by AccessDataProDiscover by Technology PathwaysSMART by ASR DataThe Sleuth Kit / AutopsySummaryBibliography

Data OrganizationBinary, Decimal, and HexadecimalData SizesStrings and Character EncodingData StructuresFlag ValuesBooting ProcessCentral Processing Units and Machine CodeBoot Code LocationsHard Disk TechnologyHard Disk Geometry and InternalsATA / IDE InterfaceTypes of Sector AddressesBIOS versus Direct AccessSCSI DrivesSummaryBibliography
IntroductionGeneral Acquisition ProcedureData Acquisition LayersAcquisition Tool TestingReading the Source DataDirect versus BIOS AccessDead versus Live AcquisitionError HandlingHost Protected AreaDevice Configuration OverlayHardware Write BlockersSoftware Write BlockersWriting the Output DataDestination LocationImage File FormatCompressing the Image FileNetwork-based AcquisitionIntegrity HashesA Case Study Using ddInput SourcesHPAOutput DestinationsError HandlingCryptographic HashesSummaryBibliography
IntroductionBackgroundVolume ConceptsGeneral Theory of PartitionsUsage of Volumes in UNIXGeneral Theory of Volume AssemblySector AddressingAnalysis BasicsAnalysis TechniquesConsistency ChecksExtracting the Partition ContentsRecovering Deleted PartitionsSummary
DOS PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummaryApple PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummaryRemovable MediaBibliography
BSD PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummarySun Solaris SlicesGeneral OverviewSparc Data Structuresi386 Data StructuresAnalysis ConsiderationsSummaryGPT PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummaryBibliography
RAIDRAID LevelsHardware RAIDSoftware RAIDGeneral Analysis CommentsSummaryDisk SpanningOverviewLinux MDLinux LVMMicrosoft Windows LDMBibliography
What Is a File System?Data CategoriesEssential and Non-Essential DataAnalysis by CategoryFile System CategoryAnalysis TechniquesContent CategoryGeneral InformationAnalysis TechniquesWiping TechniquesMetadata CategoryGeneral InformationAnalysis TechniquesFile Name CategoryGeneral InformationAnalysis TechniquesWiping TechniquesApplication CategoryFile System JournalsApplication-level Search TechniquesApplication-based File Recovery (Data Carving)File Type SortingSpecific File SystemsSummaryBibliography
IntroductionFile System CategoryAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioContent CategoryAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioMetadata CategoryAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenariosFile Name CategoryAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenariosThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryDetermining the TypeConsistency CheckSummaryBibliography
Boot SectorFAT32 FSINFOFATDirectory EntriesLong File Name Directory EntriesSummaryBibliography
IntroductionEverything is a FileMFT ConceptsMFT Entry ContentsMFT Entry AddressesFile System Metadata FilesMFT Entry Attribute ConceptsAttribute HeadersAttribute ContentStandard Attribute TypesOther Attribute ConceptsBase MFT EntriesSparse AttributesCompressed AttributesEncrypted AttributesIndexesB-TreesNTFS Index AttributesAnalysis ToolsSummaryBibliography
File System Category$MFT File Overview$MFTMirr File Overview$Boot File Overview$Volume File Overview$AttrDef File OverviewExample ImageAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioContent CategoryClusters$Bitmap File Overview$BadClus File OverviewAllocation AlgorithmsFile System LayoutAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioMetadata Category$Standard_Information Attribute$FILE_NAME Attribute$DATA Attribute$ATTRIBUTE_LIST Attribute$SECURITY_DESCRIPTOR Attribute$Secure FileExample ImageAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioFile Name CategoryDirectory IndexesRoot DirectoryLinks to Files and DirectoriesObject IdentifiersAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioApplication CategoryDisk QuotasLogging—File System JournalingChange JournalThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryConsistency CheckSummaryBibliography
Basic ConceptsFixup ValuesMFT Entries (File Records)Attribute HeaderStandard File Attributes$STANDARD_INFORMATION Attribute$FILE_NAME Attribute$DATA Attribute$ATTRIBUTE_LIST Attribute$OBJECT_ID Attribute$REPARSE_POINT AttributeIndex Attributes and Data Structures$INDEX_ROOT Attribute$INDEX_ALLOCATION Attribute$BITMAP AttributeIndex Node Header Data StructureGeneric Index Entry Data StructureDirectory Index Entry Data StructureFile System Metadata Files$MFT File$Boot File$AttrDef File$Bitmap File$Volume File$ObjId File$Quota File$LogFile File$UsrJrnl FileSummaryBibliography
IntroductionFile System CategoryOverviewAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioContent CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioMetadata CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioFile Name CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenariosApplication CategoryFile System JournalingAnalysis ScenarioThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryConsistency CheckSummaryBibliography
SuperblockGroup Descriptor TablesBlock BitmapInodesExtended AttributesDirectory EntrySymbolic LinkHash TreesJournal Data StructuresSummaryBibliography
IntroductionFile System CategoryOverviewAnalysis TechniquesAnalysis ConsiderationsContent CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsMetadata CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsFile Name CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryConsistency CheckSummaryBibliography
UFS1 SuperblockUFS2 SuperblockCylinder Group SummaryUFS1 Group DescriptorUFS2 Group DescriptorBlock and Fragment BitmapsUFS1 InodesUFS2 InodesUFS2 Extended AttributesDirectory EntriesSummaryBibliography
The Sleuth KitDisk ToolsVolume System ToolsFile System ToolsSearching ToolsAutopsyAnalysis ModesBibliography

Content preview from File System Forensic Analysis

13. NTFS Data Structures

This is the third and final chapter devoted to NTFS, and here we will examine its data structures. The previous two chapters examined the basic concepts of NTFS and how to analyze it. For many, the information covered thus far is sufficient, but others of us want to know more about what is going on. This chapter is organized so that we cover the data structures of the basic elements first and then examine the specific attributes and index types. Lastly, the file system metadata files are covered. Unlike the other file system chapters, this one was written so that it should be read after Chapter 11, “NTFS Concepts,” and Chapter 12, “NTFS Analysis.” The first part of the chapter can be read in parallel with Chapter 11