Diapositiva 1 - Università degli studi di Pavia

Transcript

(Corso)
An Introduction to File System Forensic Analysis
Antonio Barili
Laboratorio di informatica Forense
Dipartimento di Ingegneria Industriale e dell’Informazione
Università degli Studi di Pavia
[email protected]
Università degli Studi di Pavia – A. Barili
1
Foreword
Computer Forensics
Digital Forensics
© Università degli Studi di Pavia, Antonio Barili
Incident Response
2
1
(Corso)
An Introduction to File System Forensics
What's in a file?
That which we call a file by any other name would smell as sweet
a record in a public office
or in a court of law
File
place in a container for
keeping records
Document
A (digital) representation of information
3
What's in a file?
File System
A data structure that provides persistent archival
services to an operating system
4
2
(Corso)
What's in a file?
Visual Metaphores to
deal with the File System
Hierarchical tree of folders containing
other folders and/or documents
5
A drive ! A drive ! My kingdom for a drive !
Persistence
6
3
(Corso)
A drive ! A drive ! My kingdom for a drive !
...
HPA
LBA Space
Available
Sectors
(0,5-4KB)
Spare
Sectors
7
Is this a volume which I see before me?
The file system does not (usually) deals
with drives, but to astraction of them
named volumes
Sectors in a volume need not be
consecutive on a physical storage device
(but they appear to be so)
8
4
(Corso)
Is this a volume which I see before me?
A volume allocated on a single drive
Two volumes on a single drive
...
A volume spanning two disks (es. RAID1 )
9
Though this be madness yet there is method in it
FS A
FS B
A
B
FS C-D
C
D
10
5
(Corso)
Screw your boot block to the sticking place
MBR/GPT
MBR:
Master Boot Record
GPT:
GUID Partition Table
11
MBR
(sector 0)
Partition # 1
{ Boot Code
PartitionTable [4]
{ Start CHS, End CHS, Start LBA, Nsect, Type, Flags }
Signature
}
12
6
(Corso)
MBR
(sector 0)
Partition # 1
MBR offset is specified in the CHS/LBA space
File System Data Structure offsets are specified in the
partition (volume) space
13
[To probe: Frhed – http://frhed.sourceforge.net]
14
7
(Corso)
Reserved Area
(1 sect)
Master Index
(directory) Area
Data Area (Data Clusters)
NOT to be confused with
“directory” files
Housekeeping
data
15
Age cannot wither her (The FAT File System)
Reserved Area
(1 sect)
FAT Area
Data Area
FAT is the original file system used in DOS and Windows 9x
Now used in Pendrives and Camera Storage Cards
[To probe: http://dmitrybrant.com/fatwalker]
16
8
(Corso)
17
18
9
(Corso)
19
20
10
(Corso)
Something is rotten in the state of Denmark
(The NTFS File System)
Boot Sector
(cluster 0)
$MFT
f00
f01
NTFS is the default file system since Ms Windows NT
“Everything is a file”
NTFS provides better resilience to system crashes
(e.g. journaling) ...
... and a huge amount of places to hide information (from users)
[To probe: http://dmitrybrant.com/fatwalker]
21
22
11
(Corso)
23
24
12
(Corso)
25
26
13
(Corso)
27
28
14
(Corso)
Men's evil manners live in brass;
their virtues we write in water
MBR
(sector 0)
Partition # 1
Formatting an hard disk overwrites the MBR, but leaves
partition content unchanged
Even if both the boot sector and the file system structures are
lost or damaged, most files will reside in contiguous clusters
an could be carved out by looking at their headers and trailers
29
30
15
(Corso)
31
32
16
(Corso)
There are more things in heaven and earth, Horatio,
Than are dreamt of in your philosophy.
(William Shakespeare, Hamlet Act 1. Scene V, 1601)
33
Riferimenti
[Carrier, 2005]
Carrier, Brian, File System Forensic Analysis, Addison-Wesley,
2005
[Sammes, 2007]
Sammes, Tony and Brian jenkinson, Forensic Computing – A
Parctitioner’s Guide, 2° Ed, Springer-Verlag, 2007
34
17
(Corso)
Il contenuto di questo documento riflette esclusivamente le opinioni dell’autore e
non impegna in alcun modo l‘Università degli Studi di Pavia.
Il contenuto di questo documento è stato curato al fine di fornire un’informazione
accurata sull’argomento trattato, non un parere legale o professionale. Se si
necessita di tale parere è necessario rivolgersi ad un professionista competente.
Data
Autore
Descrizione
06/12/2012 ab
35
18

Diapositiva 1 - Università degli studi di Pavia

Transcript

Documenti analoghi

scheda tecnica The Antiquary 12 YO

scheda tecnica The Antiquary The Finest

Dario Fo. Mistero Buffo a colori

Jorge Niosi

Invito convegno - Fondazione Romagnosi

Teatro Fraschini Gran Galà d`Autunno

OFFERTA STAGE ASM PAVIA SpA

Locandina

Vilnius piu` vicina a Pavia

Ngnitejeu Tata Samuel - Fondazione Salvatore Maugeri