ad hoc file system forensics
play

Ad-hoc File System Forensics Andreas Schuster 1 Introduction - PowerPoint PPT Presentation

Feb 07, 2024 •286 likes •564 views

Ad-hoc File System Forensics Andreas Schuster 1 Introduction Standard Operating Procedure Extract disk drive Connect to write-blocking device Create image Load image into analysis software Analyze! 2 Introduction But how

  1. Ad-hoc File System Forensics Andreas Schuster 1

  2. Introduction Standard Operating Procedure  Extract disk drive  Connect to write-blocking device  Create image  Load image into analysis software  Analyze! 2

  3. Introduction But how about printers?  Printer  Scanner  Photocopier  Fax  File server  Web server  ... and it is equipped with a disk drive! 3

  4. Introduction Standard hardware?  Carrier plate  Standard ATA disk  Apply Standard Operating Procedure  Extract disk drive  Connect to write-blocking device  Create image  Load into analysis software 4

  5. Introduction Unrecognized file system - now what? 5

  6. Analysis Process 1. Physical disk examination 2. Volume examination 3. File system layout 4. File name information 5. File metadata 6. File content 6

  7. Physical Disk Examination Tools  Tableau write-blocking ATA/FW bridge  Tableau Disk Monitor http://www.tableau.com/  tableau-parm http://projects.sentinelchicken.org/tableau-parm

  8. Physical Disk Examination Disk Information Vendor (empty) Model HP J6054B Revision AD101A Serial number 169V0029T Bus type IDE Device type Simplified Direct Access Removable media? No Sector size 512 bytes HPA in use? Yes DCO in use? No Security extensions in use? No Reported capacity 37,1 GB (77.878.016 sectors) HPA capacity 37,3 GB (78.140.160 sectors) DCO capacity 37,3 GB (78.140.160 sectors)

  9. Volume Examination Tools  TestDisk by Christophe Grennier http://www.cgsecurity.org/wiki/TestDisk  Available for MS Win, Linux, *BSD, SunOS, Mac OS X  Override disk geometry parameters for a really deep scan  sectors = 1  heads = 1 9

  10. Volume Examination Testdisk 10

  11. Shannon‘s Entropy Assumptions  Alphabet of 256 characters  1 byte per character  Block size >> size of alphabet 11

  12. Shannon‘s Entropy Tools  Python http://www.python.org/  SQLite http://www.sqlite.org/  Gnuplot http://www.gnuplot.info/ 12

  13. Shannon‘s Entropy 1 st attempt gnuplot> set style data dots gnuplot> set datafile separator "|" gnuplot> plot "< sqlite3 myfile.db3 'SELECT * FROM tbl_entropy WHERE offset BETWEEN 0 AND 1*512*1024*1024;'" notitle 13

  14. Shannon‘s Entropy Plot of first 512 MiB 14

  15. Shannon‘s Entropy Zoom in on the first sectors gnuplot> set style data dots gnuplot> set logscale x 10 gnuplot> set datafile separator "|" gnuplot> plot "< sqlite3 myfile.db3 'SELECT * FROM tbl_entropy WHERE offset BETWEEN 0 AND 1*512*1024*1024;'" notitle 15

  16. Shannon‘s Entropy Plot of first 512 MiB 16

  17. Shannon‘s Entropy Add a bit of color gnuplot> set style data impulses gnuplot> set cbrange [0:8] gnuplot> set logscale x 10 gnuplot> set datafile separator "|" gnuplot> plot "< sqlite3 myfile.db3 'SELECT * FROM tbl_entropy WHERE offset BETWEEN 0 AND 1*512*1024*1024;'" notitle palette 17

  18. Shannon‘s Entropy Plot of first 512 MiB 18

  19. Area 1 MBR followed by blank sectors $ hexdump -C -n 32768 -s 0 4100_spool.001 00000000 00 00 00 48 50 75 78 31 2e 30 30 00 00 00 00 00 |...HPux1.00.....| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000001c0 00 00 40 00 00 00 3f 00 00 00 11 4f a4 04 00 00 |..@...?....O....| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.| 00000200 00 00 00 62 6c 61 6e 6b 00 00 00 00 00 00 00 00 |...blank........| 00000210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000400 00 00 00 62 6c 61 6e 6b 00 00 00 00 00 00 00 00 |...blank........| 00000410 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| ... 00007c00 00 00 00 62 6c 61 6e 6b 00 00 00 00 00 00 00 00 |...blank........| 00007c10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00007e00 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 |................| * 00008000 19

  20. Area 2 File system layout $ hexdump -C -n 32768 -s 32768 4100_spool.001 00008000 00 00 00 02 00 00 00 00 00 04 a4 00 00 12 91 3c |...............<| 00008010 00 00 00 00 00 00 00 00 00 04 a3 ff 00 12 8c 91 |................| 00008020 00 00 00 00 00 00 00 00 11 11 22 22 00 00 00 1b |..........""....| 00008030 ca fe fe ca 00 00 80 00 1f ed fa ce 00 00 04 a7 |................| 00008040 00 00 00 10 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 00008050 e5 e5 e5 e5 e5 e5 e5 e5 3f ff ff ff ff ff ff ff |........?.......| 00008060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 00008180 ff 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00008190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00008200 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 |................| * 0000fe00 00 00 06 03 00 00 00 00 00 04 a4 00 00 12 91 3c |...............<| 0000fe10 00 00 00 01 e5 e5 e5 e5 00 04 9d fc 00 12 84 06 |................| 0000fe20 e5 e5 e5 e5 00 00 01 00 11 11 22 22 00 00 00 1b |..........""....| 0000fe30 ca fe fe ca 00 00 80 00 1f ed fa ce 00 00 04 a7 |................| 0000fe40 00 00 00 10 e5 e5 e5 e5 00 04 a2 03 00 00 00 00 |................| 0000fe50 ff ff e5 e5 e5 e5 e5 e5 03 ff ff ff ff ff ff ff |................| 0000fe60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 0000ff80 ff 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 0000ff90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 20 00010000

  21. Area 3 Inodes $ hexdump -C -n 512 -s 97792 4100_spool.001 00017e00 41 ff 00 0a 00 00 00 00 00 00 00 00 00 00 02 00 |A...............| 00017e10 00 00 0e ea 00 00 0e 4b 00 00 0e 4b 00 00 00 01 |.......K...K....| 00017e20 00 04 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00017e30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00017e40 00 00 00 00 00 00 00 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 00017e50 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00017e80 41 f8 00 02 00 00 00 00 00 00 00 00 00 00 04 00 |A...............| 00017e90 00 00 0e e4 00 00 00 20 00 00 00 20 00 00 00 01 |....... ... ....| 00017ea0 00 04 ab 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00017eb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00017ec0 00 00 00 00 00 00 00 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 00017ed0 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| $ hexdump -C -n 512 -s 284160 4100_spool.001 00045600 81 ff 00 01 00 00 00 01 00 06 00 00 00 05 6c 76 |..............lv| 00045610 00 00 0e 4c 00 00 0e 4d 00 00 0e 4d 00 00 00 0c |...L...M...M....| 00045620 00 0c e7 00 0c e8 00 0c e9 00 0c ea 00 0c eb 00 |................| 00045630 0c ec 00 0c ed 00 0c ee 00 0c ef 00 0c f0 00 0c |................| 00045640 f1 00 00 00 00 00 00 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 00045650 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 21

  22. Area 4 Unused inodes and endianess $ hexdump -C -n 1024 -s 295424 4100_spool.001 00048200 00 00 06 0a 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048210 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048280 00 00 06 0b 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048290 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048300 00 00 06 0c 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048310 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048380 00 00 06 0d 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048390 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048400 00 00 06 0e 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048410 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048480 00 00 06 0f 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048490 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048500 00 00 06 10 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048510 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00048580 00 00 06 11 00 00 00 00 ff ff e5 e5 e5 e5 e5 e5 |................| 00048590 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 22

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

2015-2017 (c) P.Pale: Computer Forensics 2015-10-17 File System Forensics A New York

2015-2017 (c) P.Pale: Computer Forensics 2015-10-17 File System Forensics A New York

2015-2017 (c) P.Pale: Computer Forensics 2015-10-17 File System Forensics A New York computer forensics firm found that 40% of the hard disk drives it recently purchased in bulk orders on eBay contained personal, private and sensitive

884 views • 70 slides
CSN11121/CSN11122 System Administration and Forensics File System 28/10/2011

CSN11121/CSN11122 System Administration and Forensics File System 28/10/2011

CSN11121/CSN11122 System Administration and Forensics File System 28/10/2011 r.ludwiniak@napier.ac.uk Lecture Objectives 1. Investigative Process Analysis Framework 2. File Systems FAT NTFS Required Reading G.H. Fellow,

705 views • 51 slides
DFIR FILE SYSTEM FORENSICS DEV DUA (@dev0x01) &gt;&gt; whois Dev.Dua # Star Wars fan, clearly.

DFIR FILE SYSTEM FORENSICS DEV DUA (@dev0x01) &gt;&gt; whois Dev.Dua # Star Wars fan, clearly.

DFIR FILE SYSTEM FORENSICS DEV DUA (@dev0x01) &gt;&gt; whois Dev.Dua # Star Wars fan, clearly. # M.Eng. Cybersecurity # JOATMON Full Stack Developer, Security Engineer, Scripting/Automation, Researcher # Twitter: dev0x01 # Web:

1.03k views • 43 slides
CSN08101 Digital Forensics Lecture 8: File Systems Lecture 8: File Systems Module Leader: Dr

CSN08101 Digital Forensics Lecture 8: File Systems Lecture 8: File Systems Module Leader: Dr

CSN08101 Digital Forensics Lecture 8: File Systems Lecture 8: File Systems Module Leader: Dr Gordon Russell Lecturers: Robert Ludwiniak Objectives Investigative Process Analysis Framework last week File Systems File

795 views • 50 slides
Digital forensics and malware Digital forensics According to Wikipedia, you could be looking

Digital forensics and malware Digital forensics According to Wikipedia, you could be looking

Digital forensics and malware Digital forensics According to Wikipedia, you could be looking for: attribution, alibis and statements, intent, evaluation of source, document authentication File carving ( e.g. , bifragment gap carving)

630 views • 13 slides
CSE 469: Computer and Network Forensics Topic 5: Image Forensics Dr. Mike Mabey | Spring 2019

CSE 469: Computer and Network Forensics Topic 5: Image Forensics Dr. Mike Mabey | Spring 2019

CSE 469: Computer and Network Forensics Topic 5: Image Forensics Dr. Mike Mabey | Spring 2019 CSE 469: Computer and Network Forensics Forensics for Graphics Files Types of graphics file formats Type of data compression How to locate

362 views • 25 slides
Chapter 12: File System Implementation File System Structure File System Implementation

Chapter 12: File System Implementation File System Structure File System Implementation

Chapter 12: File System Implementation File System Structure File System Implementation Directory Implementation Allocation Methods Free-Space Management Efficiency and Performance Recovery Log-Structured File Systems

492 views • 47 slides
CSE 469: Computer and Network Forensics Topic 4: File Systems Dr. Mike Mabey | Spring 2019 CSE

CSE 469: Computer and Network Forensics Topic 4: File Systems Dr. Mike Mabey | Spring 2019 CSE

CSE 469: Computer and Network Forensics Topic 4: File Systems Dr. Mike Mabey | Spring 2019 CSE 469: Computer and Network Forensics My Sources https://smile.amazon.com/Underst https://smile.amazon.com/System-

697 views • 46 slides
~FILE SYSTEM~ SUNU WIBIRAMA OUTLINE FILE SYSTEM ACCESS METHODS DIRECTORY STRUCTURE FILE

~FILE SYSTEM~ SUNU WIBIRAMA OUTLINE FILE SYSTEM ACCESS METHODS DIRECTORY STRUCTURE FILE

~FILE SYSTEM~ SUNU WIBIRAMA OUTLINE FILE SYSTEM ACCESS METHODS DIRECTORY STRUCTURE FILE SYSTEM MOUNTING PROTECTION EXTERNAL VIEW OF THE FILE MANAGER FILE MANAGEMENT FILE, IS A NAMED AND ORDERED COLLECTION OF INFORMATION COMPUTER SHOULD

341 views • 33 slides
File Systems Chapter 11, 13 OSPP What is a File? What is a Directory? Goals of File System

File Systems Chapter 11, 13 OSPP What is a File? What is a Directory? Goals of File System

File Systems Chapter 11, 13 OSPP What is a File? What is a Directory? Goals of File System Performance Controlled Sharing Convenience: naming Reliability File System Workload File sizes Are most files small or large?

996 views • 62 slides
Small-block Disk Forensics and Triage Outline Disk Structure. Triage. File Signatures.

Small-block Disk Forensics and Triage Outline Disk Structure. Triage. File Signatures.

Small-block Disk Forensics and Triage Outline Disk Structure. Triage. File Signatures. Discriminators. Contraband Identification. Sector-based Hashing. Conclusions. Author: Prof Bill Buchanan Small Block Disk Forensics and

768 views • 45 slides
CSE 120 File System Interface What the user/programmer sees File System Implementation

CSE 120 File System Interface What the user/programmer sees File System Implementation

Overview CSE 120 File System Interface What the user/programmer sees File System Implementation How it works Summer, 2006 Day 9 File Systems Instructor: Neil Rhodes 2 What is a File? Typical Filesystem Named collection of related

175 views • 5 slides
File System Implementation Summer 2016 Cornell University Today File allocation Unix

File System Implementation Summer 2016 Cornell University Today File allocation Unix

CS 4410 Operating Systems File System Implementation Summer 2016 Cornell University Today File allocation Unix file system Log-structured file system 2 File system: two design problems User interface: File, directory,

362 views • 21 slides
Distributed File Systems Distributed File Systems A distributed file system (DFS) is a

Distributed File Systems Distributed File Systems A distributed file system (DFS) is a

Distributed File Systems Distributed File Systems A distributed file system (DFS) is a distributed Definitions implementation of a classical time-sharing model of a file Distributed system - A number of loosely coupled system. machines

997 views • 8 slides
Windows File System Efficiency and Stability of a file system are contradicting requirements. How

Windows File System Efficiency and Stability of a file system are contradicting requirements. How

Unit OS8: File System 8.6. Quiz Windows Operating System Internals - by David A. Solomon and Mark E. Russinovich with Andreas Polze Windows File System Efficiency and Stability of a file system are contradicting requirements. How can the

279 views • 11 slides
Distributed Systems - III Open a file, check status on a file, close a file; Read data

Distributed Systems - III Open a file, check status on a file, close a file; Read data

CSE 421/521 - Operating Systems What does Distributed File System Provide? Fall 2011 Provide access to and manipulation of data stored at remote servers using file system interfaces Lecture - XXV What are the file system interfaces?

236 views • 5 slides
Hash Proof Systems and Password Protocols III SPHF-based PAKE David Pointcheval CNRS, Ecole

Hash Proof Systems and Password Protocols III SPHF-based PAKE David Pointcheval CNRS, Ecole

Hash Proof Systems and Password Protocols III SPHF-based PAKE David Pointcheval CNRS, Ecole normale sup erieure/PSL &amp; INRIA 8th BIU Winter School Key Exchange February 2018 CNRS/ENS/PSL/INRIA David Pointcheval 1/53 Intuition

475 views • 18 slides
Oregon APAC- Leveraging Race &amp; Ethnicity Data From Other State Data Sources 2020 NAHDO

Oregon APAC- Leveraging Race &amp; Ethnicity Data From Other State Data Sources 2020 NAHDO

Oregon APAC- Leveraging Race &amp; Ethnicity Data From Other State Data Sources 2020 NAHDO Conference Presentation 8/26/20 Mary Ann Evans, MS, MPH, PhD Analyst, Oregon Health Authority, Health Analytics Collaboration &amp; Acknowledgement

511 views • 18 slides
Ensemble sensitivity and sampling error correction evaluated using a convective-scale 1000 member

Ensemble sensitivity and sampling error correction evaluated using a convective-scale 1000 member

Ensemble sensitivity and sampling error correction evaluated using a convective-scale 1000 member ensemble Tobias Necker (LMU) M. Weissmann (LMU, DWD), S. Geiss (LMU), T. Miyoshi (RIKEN), J. Ruiz (CIMA), G.-Y. Lien (TCBW) and J. Anderson (NCAR)

610 views • 16 slides
Data Assimilation: Finding the Initial Conditions in Large Dynamical Systems Eric Kostelich

Data Assimilation: Finding the Initial Conditions in Large Dynamical Systems Eric Kostelich

Data Assimilation: Finding the Initial Conditions in Large Dynamical Systems Eric Kostelich Data Mining Seminar, Feb. 6, 2006 kostelich@asu.edu Co-Workers Istvan Szunyogh, Gyorgyi Gyarmati, Ed Ott, Brian Hunt, Eugenia Kalnay, D. J. Patil,

506 views • 34 slides
Virtual Machines Heyi Li and Zhen Cao (Some of the figures are from the Internet) Fall 2014 ::

Virtual Machines Heyi Li and Zhen Cao (Some of the figures are from the Internet) Fall 2014 ::

Fall 2014 :: CSE 506 :: Section 2 (PhD) Virtual Machines Heyi Li and Zhen Cao (Some of the figures are from the Internet) Fall 2014 :: CSE 506 :: Section 2 (PhD) Outline Basic concepts When virtual is better Implementation When

654 views • 27 slides
PromQL for security Carlos Arilla carlos@sysdig.com carillan@gmail.com @carillan_ November

PromQL for security Carlos Arilla carlos@sysdig.com carillan@gmail.com @carillan_ November

PromQL for security Carlos Arilla carlos@sysdig.com carillan@gmail.com @carillan_ November 2019 Hello World Carlos Arilla Tech Marketing Engineer @ Sysdig Father of 3! Professional interests: Personal interests: Cloud Native

270 views • 14 slides
Checking multi-view consistency of discrete systems with respect to periodic sampling abstractions

Checking multi-view consistency of discrete systems with respect to periodic sampling abstractions

Checking multi-view consistency of discrete systems with respect to periodic sampling abstractions Maria Pittou 1 and Stavros Tripakis 2 1 Aalto University 2 Aalto University and UC Berkeley CL Day, Aalto 2016 Maria Pittou, Stavros Tripakis

1.25k views • 96 slides
Design and Implementation of an OpenFlow Hardware Abstraction Layer D. Parniewicz, R. Doriguzzi

Design and Implementation of an OpenFlow Hardware Abstraction Layer D. Parniewicz, R. Doriguzzi

Design and Implementation of an OpenFlow Hardware Abstraction Layer D. Parniewicz, R. Doriguzzi Corin, L. Ogrodowczyk, M. Rashidi Fard, J. Matias, M. Gerola, V. Fuentes, U. Toseef, A. Zaalouk, B. Belter, E. Jacob, Kostas Pentikousis ACM

110 views • 10 slides

More recommend