book

File System Forensic Analysis

by Brian Carrier

March 2005

Beginner to intermediate

600 pages

16h 26m

English

Addison-Wesley Professional

Read now

Unlock full access

RoadmapScope of BookResources
Digital Investigations and EvidenceDigital Crime Scene Investigation ProcessSystem Preservation PhaseEvidence Searching PhaseEvent Reconstruction PhaseGeneral GuidelinesData AnalysisAnalysis TypesEssential and Nonessential DataOverview of ToolkitsEnCase by Guidance SoftwareForensic Toolkit by AccessDataProDiscover by Technology PathwaysSMART by ASR DataThe Sleuth Kit / AutopsySummaryBibliography

Data OrganizationBinary, Decimal, and HexadecimalData SizesStrings and Character EncodingData StructuresFlag ValuesBooting ProcessCentral Processing Units and Machine CodeBoot Code LocationsHard Disk TechnologyHard Disk Geometry and InternalsATA / IDE InterfaceTypes of Sector AddressesBIOS versus Direct AccessSCSI DrivesSummaryBibliography
IntroductionGeneral Acquisition ProcedureData Acquisition LayersAcquisition Tool TestingReading the Source DataDirect versus BIOS AccessDead versus Live AcquisitionError HandlingHost Protected AreaDevice Configuration OverlayHardware Write BlockersSoftware Write BlockersWriting the Output DataDestination LocationImage File FormatCompressing the Image FileNetwork-based AcquisitionIntegrity HashesA Case Study Using ddInput SourcesHPAOutput DestinationsError HandlingCryptographic HashesSummaryBibliography
IntroductionBackgroundVolume ConceptsGeneral Theory of PartitionsUsage of Volumes in UNIXGeneral Theory of Volume AssemblySector AddressingAnalysis BasicsAnalysis TechniquesConsistency ChecksExtracting the Partition ContentsRecovering Deleted PartitionsSummary
DOS PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummaryApple PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummaryRemovable MediaBibliography
BSD PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummarySun Solaris SlicesGeneral OverviewSparc Data Structuresi386 Data StructuresAnalysis ConsiderationsSummaryGPT PartitionsGeneral OverviewData StructuresAnalysis ConsiderationsSummaryBibliography
RAIDRAID LevelsHardware RAIDSoftware RAIDGeneral Analysis CommentsSummaryDisk SpanningOverviewLinux MDLinux LVMMicrosoft Windows LDMBibliography
What Is a File System?Data CategoriesEssential and Non-Essential DataAnalysis by CategoryFile System CategoryAnalysis TechniquesContent CategoryGeneral InformationAnalysis TechniquesWiping TechniquesMetadata CategoryGeneral InformationAnalysis TechniquesFile Name CategoryGeneral InformationAnalysis TechniquesWiping TechniquesApplication CategoryFile System JournalsApplication-level Search TechniquesApplication-based File Recovery (Data Carving)File Type SortingSpecific File SystemsSummaryBibliography
IntroductionFile System CategoryAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioContent CategoryAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioMetadata CategoryAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenariosFile Name CategoryAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenariosThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryDetermining the TypeConsistency CheckSummaryBibliography
Boot SectorFAT32 FSINFOFATDirectory EntriesLong File Name Directory EntriesSummaryBibliography
IntroductionEverything is a FileMFT ConceptsMFT Entry ContentsMFT Entry AddressesFile System Metadata FilesMFT Entry Attribute ConceptsAttribute HeadersAttribute ContentStandard Attribute TypesOther Attribute ConceptsBase MFT EntriesSparse AttributesCompressed AttributesEncrypted AttributesIndexesB-TreesNTFS Index AttributesAnalysis ToolsSummaryBibliography
File System Category$MFT File Overview$MFTMirr File Overview$Boot File Overview$Volume File Overview$AttrDef File OverviewExample ImageAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioContent CategoryClusters$Bitmap File Overview$BadClus File OverviewAllocation AlgorithmsFile System LayoutAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioMetadata Category$Standard_Information Attribute$FILE_NAME Attribute$DATA Attribute$ATTRIBUTE_LIST Attribute$SECURITY_DESCRIPTOR Attribute$Secure FileExample ImageAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioFile Name CategoryDirectory IndexesRoot DirectoryLinks to Files and DirectoriesObject IdentifiersAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioApplication CategoryDisk QuotasLogging—File System JournalingChange JournalThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryConsistency CheckSummaryBibliography
Basic ConceptsFixup ValuesMFT Entries (File Records)Attribute HeaderStandard File Attributes$STANDARD_INFORMATION Attribute$FILE_NAME Attribute$DATA Attribute$ATTRIBUTE_LIST Attribute$OBJECT_ID Attribute$REPARSE_POINT AttributeIndex Attributes and Data Structures$INDEX_ROOT Attribute$INDEX_ALLOCATION Attribute$BITMAP AttributeIndex Node Header Data StructureGeneric Index Entry Data StructureDirectory Index Entry Data StructureFile System Metadata Files$MFT File$Boot File$AttrDef File$Bitmap File$Volume File$ObjId File$Quota File$LogFile File$UsrJrnl FileSummaryBibliography
IntroductionFile System CategoryOverviewAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioContent CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioMetadata CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenarioFile Name CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsAnalysis ScenariosApplication CategoryFile System JournalingAnalysis ScenarioThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryConsistency CheckSummaryBibliography
SuperblockGroup Descriptor TablesBlock BitmapInodesExtended AttributesDirectory EntrySymbolic LinkHash TreesJournal Data StructuresSummaryBibliography
IntroductionFile System CategoryOverviewAnalysis TechniquesAnalysis ConsiderationsContent CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsMetadata CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsFile Name CategoryOverviewAllocation AlgorithmsAnalysis TechniquesAnalysis ConsiderationsThe Big PictureFile Allocation ExampleFile Deletion ExampleOther TopicsFile RecoveryConsistency CheckSummaryBibliography
UFS1 SuperblockUFS2 SuperblockCylinder Group SummaryUFS1 Group DescriptorUFS2 Group DescriptorBlock and Fragment BitmapsUFS1 InodesUFS2 InodesUFS2 Extended AttributesDirectory EntriesSummaryBibliography
The Sleuth KitDisk ToolsVolume System ToolsFile System ToolsSearching ToolsAutopsyAnalysis ModesBibliography

Content preview from File System Forensic Analysis

16. UFS1 and UFS2 Concepts and Analysis

The Unix File System (UFS) comes in several variations and can be found in many types of UNIX systems, including FreeBSD, HP-UX, NetBSD, OpenBSD, Apple OS X, and Sun Solaris. Many OSes have modified one or more data structures over the years to suit their needs, but they all have the same concepts. Currently, the two major variations are UFS1 and UFS2. UFS2 supports larger disks and larger time stamps. I will use the term UFS to refer to both file systems. An investigator might encounter a UFS file system when investigating a Unix system, typically a server. Ext2 and Ext3 are based on UFS, and because they were already discussed in detail, this chapter will be briefer and assume that you understand the ...