Bruce Nikkel 4_2_sleuthkit_fs_analysis.pdf

Common files systems today:

• FAT
• NTFS
• EXT4
• HFS+

Newer filesystems:

• BTRFS
• APFS
• ZFS

Why filesystem forensics is doen:

• identify the filesystem used
• recover files (including deletd files)
• recover file fragments (slack, unallocated areas)
• find attempts to hide data (change *.jpg to *.exe)
• hash individual files for search and ignore (exclusion)
• analyze meta data (timestamps, ownership, etc.)
• evidence from corrupted, partially wiped filesystems
• reconstruct past events with timelines
• special topics: raid, journals, encryption

check what filesystems are supported by TSK (sluethkit)

fsstat -f list

Areas of forensic interest on a storage drive:

• sector - the smalles accessible unit of a drive
• block - consecutive sectors, smalles accessible unit on fss
• allocated blocks - fs blocks that are allocated to files
• unallocated blocks - fs blocks that are not allocated to files (previously allocated data may still exist)
• inodes - meta data describing files and directories (also MFT)
• interpartion gaps - (mmls) possible overwritten filesystems [Forensic term "slack" space]
• volume slack - between end of filesystem and end of partition
• file slack - between end of file and end of block
• ram slack - between end of flile and end of sector
• less important - 4k sectors, OSs are wiping data, TRIM

(same meaning: directories=folders, pratitions=volumes)

Via normal kernel devices:

• raw devices (/dev/sda, /dev/mmcblk0, /dev/nvme0n1)
• partition devices (/dev/sda1 or /dev/nvme0n1p1)

       Kernel loop devices can be created or removed from a forensic image:

• /dev/loop*
• $ sudo losetup -find -partscan -read-only image.dd
• $ sudo losetup -D loop0

Via calculated offsets (be careful, check the units!):

• byte offsets (character offsets could be 2 bytes - unicode)
• sector offsets (sector sizen is not always 512 bytes)
• block offsets (rememger to subract the partition sector offset)
• use shell math: $ echo $((1024000 / 512))

Forensic analysis tools act directly on the device, or on a forensically acquired image - no mounting needed.

# echo $(((sectornumber-partitionoffset)/blocksize))

# blkstat /dev/sdb1 1025

# ifind -d 1025 /dev/sdb1

# ffind /dev/sdb1 14

# ifind -n "hello.txt" /dev/sdb1

# istat /dev/sdb1 14

An inode is a data structure on a filesystem on Linux and other Unix-like operating systems that stores all the information about a file except its name and its actual data.

• Sleuthkit's blkcat
• dd

Sleuthkit's blkcat is like dd, but is more filesystem aware.

Some examples:

extract drive sectors use dd with offset:

# dd if=/dev/sda of=data.dd skip=8000 count=25

extract blocks 1000-1009 from a partition image:

#blkcat partition.dd 1000 10

extract all unallocated blocks from a filesystme:

# blkls -A partition.dd > unalloc.blkls

extract all file slack space from a file slack space from a filesystem

# blkls -s partition.dd > slack.blkls

# blkls -h image.dd 5436

For blkls readable output: "-a" for ascii, "-h" for hex, "-w" for html. Use blkcalc to map back to locations in the original image.

Following tools can be used:

• fls
• ils
• icat
• fcat

• sleuthkit "jls": list the entries in a files system journal
• sleuthkit "jcat": extract data from a file system journal

• mmcat
• mmls
• mmstat
• fsstat
• img_cat
• img_stat

• blkcalc
• blkcat
• blkls
• blkstat

• icat
• ifind 
• ils
• istat
• tsk_recover

• fcat
• ffind
• fls
• fiwalk

• jcat
• jls
• usnjls

• matchtime
• tsk_gettimes

• jpeg_extract 
• sigfind
• sorter
• srch
• strings
• tsk_comparedir
• hfind
• tsk_loaddb